Puppet Enterprise report processing deserialization flaw allows code execution on Puppet Server
Puppet Server, server management software, could be taken over by attackers!
Summary
Puppet Server's report-processing code unsafely deserializes untrusted data, so a client holding any CA-signed agent certificate can run code on the server. Where the certificate authority autosigns requests without strong verification, an unauthenticated network attacker can obtain such a certificate.
Affected when
- Certificate authority autosigns requests without strong verification
What to do
Update to 2023.8.13, 2025.12.1, or 2026.0.1 or later. If you run an older version, update and read the vendor's advisory.
Update to at least the version for your product:
- Perforce Puppet Enterprise 2023.8 2023.8.13 or later
- Perforce Puppet Enterprise 2025.0 2025.12.1 or later
- Perforce Puppet Enterprise 2026.0 2026.0.1 or later
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen