CVE-2026-115732 in Puppet Enterprise
Summary
by MITRE • 11/03/2026
Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products, allows a client that holds a CA-signed certificate whose name extends or shortens an authorized hostname to be authorized as that host. This enables impersonation of other nodes and, in Puppet Enterprise, access to certificate-authority administration and remote command execution on managed nodes. Exploitation requires a certificate with a colliding name, which the certificate authority issues by approval or autosign.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified as incorrect authorization within the trapperkeeper-authorization component of Puppet Server represents a critical flaw in how hostname validation is performed during TLS handshake and authentication processes. This issue specifically affects the mechanism used to match client certificates against authorized hostnames, allowing for certificate name collision attacks where a malicious actor can exploit ambiguities or insufficient strictness in string comparison logic. When a client presents a Certificate Authority-signed certificate, the system fails to enforce exact hostname matching rules strictly enough to prevent partial matches that extend or shorten the expected authorized hostname. This technical flaw effectively bypasses identity verification protocols designed to ensure that only legitimate, pre-approved nodes can interact with the Puppet infrastructure.
From an operational perspective, this vulnerability enables significant security breaches including node impersonation and unauthorized administrative access. An attacker possessing a CA-signed certificate whose Common Name or Subject Alternative Names extend or shorten an authorized hostname can successfully authenticate as that target host. In environments running Puppet Enterprise, the consequences are severe because authentication grants more than just basic agent functionality; it provides access to Certificate Authority administration capabilities and allows for remote command execution on managed nodes under the guise of a trusted system entity. This means an attacker could potentially compromise the entire configuration management infrastructure by masquerading as critical servers or administrators.
The exploitation vector requires that the malicious actor obtain a certificate with a colliding name, which typically necessitates either approval from a Certificate Authority administrator or the presence of autosigning configurations that do not adequately validate hostname constraints before issuing certificates. This dependency highlights how misconfigurations in PKI policies can amplify technical vulnerabilities into full-scale infrastructure compromises. The attack aligns closely with CWE-287 Improper Authentication, as it involves failing to correctly verify identity credentials during access control decisions. Furthermore, the ability to impersonate nodes and execute remote commands maps directly to MITRE ATT&CK techniques such as T1078 Valid Accounts for initial access via compromised certificates and T1059 Command and Scripting Interpreter if command execution is leveraged post-authentication.
Mitigation strategies must focus on both technical configuration hardening and procedural changes within the PKI ecosystem. Administrators should ensure that hostname matching logic in trapperkeeper-authorization enforces strict, exact string comparisons without allowing partial or substring matches against authorized hostnames. It is crucial to review Certificate Authority policies to disable autosigning for sensitive domains unless absolutely necessary and to implement rigorous manual approval workflows for all certificate requests involving production hosts. Additionally, organizations should audit their existing certificates for any that might exploit these naming ambiguities and rotate credentials immediately if suspicious patterns are detected. Regularly updating Puppet Server components to versions where this authorization logic has been corrected is essential to closing the gap between intended security posture and actual implementation behavior.