ETK-2026-3409Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-3409",
  "cve_id": null,
  "display_id": "ETK-2026-3409",
  "ghsa_id": "GHSA-q4hm-33rc-572g",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Hostname authorization bypass in OpenVox Server and OpenVoxDB",
  "summary": "OpenVox Server and OpenVoxDB have a hostname authorization flaw that may allow a client certificate for one hostname to be accepted as another node. An attacker able to obtain a client certificate can impersonate a managed node and access its catalog or submit false node information; the described certificate enrollment path depends on autosigning being enabled.",
  "mitigation": "Upgrade Server to 9.2.0 and 8.18.0; OpenVoxDB to 9.2.0 and 8.18.0 or later.",
  "vendor": "openvox/puppet",
  "product": "openvox/puppet:OpenVox Server",
  "affected": [
    {
      "affected_notes": [
        "<= 9.1.0 and <= 8.17.0"
      ],
      "affected_ranges": [],
      "ecosystem": "openvox/puppet",
      "fixed_versions": [
        "9.2.0 and 8.18.0"
      ],
      "package_name": "OpenVox Server",
      "purl": null
    },
    {
      "affected_notes": [
        "<= 9.1.0 and <= 8.17.0"
      ],
      "affected_ranges": [],
      "ecosystem": "openvox/puppet",
      "fixed_versions": [
        "9.2.0 and 8.18.0"
      ],
      "package_name": "OpenVoxDB",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 40.95171596666667,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-11-03T20:05:00+00:00",
      "days": -0.15356119773148147,
      "is_lower_bound": true,
      "measured_at": "2026-11-03T23:46:07.935384+00:00",
      "url": "https://github.com/OpenVoxProject/trapperkeeper-authorization/security/advisories/GHSA-q4hm-33rc-572g"
    }
  }
}