Puppet Enterprise: Incorrect Comparison
CVE-2026-115732 is a critical-severity incorrect comparison vulnerability in Puppet Enterprise from Perforce, with a CVSS 4.0 base score of 9.0 out of 10. It can be exploited remotely over the network by an attacker with a low-privileged account, without any action from a user. The record lists versions 2023.8.13, 2025.12.1, 2026.0.1 as the first without the flaw, so updating Puppet Enterprise to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.74% chance of exploitation within 30 days, higher than 55% of scored CVEs.
Critical severity: a successful attack would have severe impact.
What to do
- Update Puppet Enterprise to 2023.8.13 or 2025.12.1 or 2026.0.1, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Perforce | Puppet Enterprise | 2023.8.0 up to, but not including, 2023.8.13; 2025.0.0 up to, but not including, 2025.12.1; 2026.0.0 up to, but not including, 2026.0.1 | 2023.8.13, 2025.12.1, 2026.0.1 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Attack requirements
- PresentThe target must be in a specific state or configuration for the attack to work.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Confidentiality (vulnerable system)
- HighSerious loss of confidentiality on the vulnerable system.
- Integrity (vulnerable system)
- HighSerious loss of integrity on the vulnerable system.
- Availability (vulnerable system)
- HighSerious loss of availability on the vulnerable system.
- Confidentiality (other systems)
- HighSerious loss of confidentiality on systems beyond the vulnerable one.
- Integrity (other systems)
- HighSerious loss of integrity on systems beyond the vulnerable one.
- Availability (other systems)
- HighSerious loss of availability on systems beyond the vulnerable one.
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. Scored by CNA (puppet.com).
Official description
Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products, allows a client that holds a CA-signed certificate whose name extends or shortens an authorized hostname to be authorized as that host. This enables impersonation of other nodes and, in Puppet Enterprise, access to certificate-authority administration and remote command execution on managed nodes. Exploitation requires a certificate with a colliding name, which the certificate authority issues by approval or autosign.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Incorrect Comparison
The product compares two entities in a security-relevant context, but the comparison is incorrect.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Other vulnerabilities in Puppet Enterprise
- 9.4 Critical severity
- 8.8 High severity
Recent Incorrect Comparison vulnerabilities
- 7.3 High severity
- 8.8 High severity
- 7.1 High severity
- 7.5 High severity
- 7.1 High severity
- 8.8 High severity
Spotted an error? Tell us.