CVE-2026-115732

The record

Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products, allows a client that holds a CA-signed certificate whose name extends or shortens an authorized hostname to be authorized as that host. This enables impersonation of other nodes and, in Puppet Enterprise, access to certificate-authority administration and remote command execution on managed nodes. Exploitation requires a certificate with a colliding name, which the certificate authority issues by approval or autosign.

Affected packages

Related vulnerabilities

• CVE-2026-71892 In Bouncy Castle for Java before 1.86, the opt-in key-size validation on CMS… CWE-697
• CVE-2026-101913 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in… CWE-697
• CVE-2026-101912 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in… CWE-697
• CVE-2026-90711 proxy-addr is a Node.js module that determines a request's client address behind trusted… CWE-697
• CVE-2026-64836 ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control… CWE-697
• CVE-2026-56101 OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the… CWE-697
• CVE-2026-73309 XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token… CWE-697
• CVE-2026-80227 Incorrect Comparison vulnerability in ash-project ash_sql allows a user to pad a string… CWE-697