CVE-2026-115731: Critical RCE in Puppet Server Report Processing

CVE-2026-115731 is an uncontrolled deserialization vulnerability in Puppet Server's report-processing code. An authenticated client with a CA-signed certificate can submit a report with malicious rich-data via PUT request to execute arbitrary code with service privileges. If the CA autosigns without strong verification, an unauthenticated network attacker can obtain the certificate. It affects administrators managing Puppet infrastructure in production.

The vulnerability is assigned a CVSS score of 9.4 and declared critical. It was published by NIST on November 3, 2026. On Twitter and social platforms, 2 posts in the last 24 hours with 6 total interactions confirm moderate awareness in the community. No public exploit has been confirmed on GitHub repositories, but risk remains high for unpatched instances given the critical value of the attack vector.

Priority defense is immediate inventory of all Puppet Server instances in production and evaluation of upgrade to a version containing the fix. Public signals indicate Puppet Enterprise 2023.8.13 among patched versions.

Review Certificate Authority configuration: if autosign is enabled, restrict it or introduce strong identity verification before signing to limit certificate issuance to legitimate agents only. Monitor Puppet Server logs for attempted report submissions with suspicious payloads.

Verify that the Puppet service running with minimal privileges is correctly configured.