OpenVox/Puppet Server: report-deserialization RCE and certname spoofing (CVE-2026-115731, CVE-2026-115732)
Severity: critical · Patch status: patched · Since 2026-10-21 · CVE-2026-115731, CVE-2026-115732
On 2026-11-03 the OpenVox project released fixes for two critical flaws it says affect every known OpenVox and Puppet implementation, including Puppet Enterprise. CVE-2026-115731 (CVSS 4.0 9.4, NVD) lets a holder of any CA-signed agent certificate run code as the Puppet Server service user by submitting a report containing a crafted serialized rich-data type; where the CA autosigns, an unauthenticated network attacker can obtain such a certificate first. CVE-2026-115732 (CVSS 4.0 9.0, NVD) is a name-matching flaw in trapperkeeper-authorization: a certificate whose name extends or shortens an authorized hostname (for example evil.target.example.com for target.example.com) is accepted as that host, giving access to its data and actions and, in some non-default setups, injection of exported resources into other agents' catalogs. Exploiting it needs a certificate with a colliding name, which the CA issues by approval or autosign. A third, container-only issue (GHSA-c4wc-g5pp-7wfp, published 2026-10-21, rated critical) left the container-openvoxdb API open to any requester when the certificate allowlist script failed to generate its file. Fixed releases: openvox-agent 9.3.0 and 8.32.0, openvox-server 9.2.0 and 8.18.0, openvoxdb 9.2.0 and 8.18.0, and container-openvoxdb 8.18.0 or later. Neodyme (Alain) reported the server issues; the container issue was reported by genetech. No exploitation is reported in the project advisories, the blog or CISA KEV, which did not list either CVE when checked on 2026-11-04.
What to do
- Upgrade openvox-agent to 9.3.0 or 8.32.0 or later, openvox-server to 9.2.0 or 8.18.0 or later, and openvoxdb to 9.2.0 or 8.18.0 or later, including bundled and repackaged builds
- Upgrade container-openvoxdb to tag 8.18.0 or later (or latest), per the Vox Pupuli blog
- Puppet Enterprise users: apply the vendor's fixed release, which the project says shipped on the same coordinated date
- If you cannot upgrade yet, restrict Puppet Server reachability to the network segments that need it, tighten or disable autosign, and disable OpenVoxDB access for individual nodes in serverless setups (Vox Pupuli mitigations)
- After upgrading, re-validate auth.conf plain-string and wildcard certname rules; some may have depended on the buggy matching
- Review server logs for report submissions containing serialized rich-data types and for unexpected exported resources; review CA-issued certificates whose names extend or shorten your node names
- Migrate any Open Source Puppet usage to OpenVox, because Puppet will not receive further security updates
Fixed versions
- openvox-agent 9.3.0, 8.32.0
- openvox-server 9.2.0, 8.18.0
- openvoxdb 9.2.0, 8.18.0
- container-openvoxdb 8.18.0 or later (the blog's guidance; GHSA-c4wc-g5pp-7wfp lists 8.17.0 as first patched)
Sources
All live incidents on Threat Watch
