Puppet Enterprise CVE-2026-115732

The attacker must hold a CA-signed certificate whose node name string either extends or shortens an already-authorized hostname, producing a name collision that the certificate-name matching logic treats as the authorized host. This requires the Puppet certificate authority to actually issue such a certificate, which happens either by administrator approval of a signing request or automatically where autosign is enabled - so autosign-enabled deployments are materially easier to exploit, while approval-gated CAs require tricking or compromising the signing step. Limiting factors: the CVSS 4.0 vector's PR:L and AT:P confirm the attacker needs a legitimate CA-signed credential and does not fully control the triggering condition; the certificate-authority administration and remote-command-execution escalation is specific to Puppet Enterprise. No user interaction is required (UI:N).

This is a genuine high-priority issue, not a high-CVSS-but-low-risk artifact. The vuln.today Decision label is act_now and the vendor (Perforce) rates it 9.0 (CVSS 4.0), driven by an incorrect-authorization flaw (CWE-863) that yields full impersonation and, in Puppet Enterprise, certificate-authority administration and remote command execution on managed nodes - i.e. high confidentiality, integrity and availability impact on both the vulnerable and subsequent systems (VC/VI/VA:H, SC/SI/SA:H). The CVSS 4.0 vector reports AV:N/AC:L/PR:L/UI:N, meaning network-reachable and low-privilege, but AT:P (attack requirement present) reflects the real gating factor: the attacker does not fully control it, because the CA must issue a certificate with a colliding name. No EPSS score, KEV listing, or PoC/exploit reference is present in the supplied input - absence of these is not evidence of safety, but it means there is no public exploit identified at time of analysis and no confirmed active exploitation. The practical risk therefore hinges on CA configuration: environments running autosign are substantially more exposed than those requiring manual certificate approval. Net: treat as act_now per the decision signal, while recognizing exploitation is conditioned on obtaining a colliding-name certificate.

An attacker obtains a CA-signed certificate whose node name extends or shortens a legitimate authorized hostname, which the Puppet CA issues either through manual approval or (far more easily) through enabled autosign. Presenting that certificate, the attacker is incorrectly authorized as the target host and can impersonate it; in Puppet Enterprise this extends to certificate-authority administration and remote command execution on managed nodes. No public exploit was identified in the available sources.