{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-115732","assignerOrgId":"ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e","state":"PUBLISHED","assignerShortName":"Perforce","dateReserved":"2026-10-23T11:46:46.648Z","datePublished":"2026-11-03T20:38:24.169Z","dateUpdated":"2026-11-03T20:38:24.169Z"},"containers":{"cna":{"providerMetadata":{"orgId":"ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e","shortName":"Perforce","dateUpdated":"2026-11-03T20:38:24.169Z"},"title":"Certificate Name Authorization Bypass","problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-863","description":"CWE-863 Incorrect Authorization","type":"CWE"},{"lang":"en","cweId":"CWE-697","description":"CWE-697 Incorrect Comparison","type":"CWE"}]}],"impacts":[{"capecId":"CAPEC-151","descriptions":[{"lang":"en","value":"CAPEC-151 Identity Spoofing"}]},{"capecId":"CAPEC-115","descriptions":[{"lang":"en","value":"CAPEC-115 Authentication Bypass"}]}],"affected":[{"vendor":"Perforce","product":"Puppet Enterprise","versions":[{"status":"affected","version":"2023.8.0","lessThan":"2023.8.13","versionType":"custom"},{"status":"affected","version":"2025.0.0","lessThan":"2025.12.1","versionType":"custom"},{"status":"affected","version":"2026.0.0","lessThan":"2026.0.1","versionType":"custom"},{"status":"unaffected","version":"2023.8.13"},{"status":"unaffected","version":"2025.12.1"},{"status":"unaffected","version":"2026.0.1"}],"defaultStatus":"affected"}],"descriptions":[{"lang":"en","value":"Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products, allows a client that holds a CA-signed certificate whose name extends or shortens an authorized hostname to be authorized as that host. This enables impersonation of other nodes and, in Puppet Enterprise, access to certificate-authority administration and remote command execution on managed nodes. Exploitation requires a certificate with a colliding name, which the certificate authority issues by approval or autosign.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products, allows a client that holds a CA-signed certificate whose name extends or shortens an authorized hostname to be authorized as that host. This enables impersonation of other nodes and, in Puppet Enterprise, access to certificate-authority administration and remote command execution on managed nodes. Exploitation requires a certificate with a colliding name, which the certificate authority issues by approval or autosign.</p>"}]}],"references":[{"url":"https://portal.perforce.com/s/cve/a91Qi000003IaJRIA0/certificate-name-authorization-bypass"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"CRITICAL","baseScore":9,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}}],"solutions":[{"lang":"en","value":"Upgrade to Puppet Enterprise 2023.8.13, 2025.12.1, or 2026.0.1 as applicable. The fix ships to every service that uses the library.","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>Upgrade to Puppet Enterprise 2023.8.13, 2025.12.1, or 2026.0.1 as applicable. The fix ships to every service that uses the library.</p>"}]}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.5"}}}}