Puppet Enterprise certificate name check bypass
A company server management tool could be used to run commands on other machines!
Summary
A flaw in how Puppet Server matches certificate names lets a client with a slightly different certificate name be authorized as another host. In Puppet Enterprise this can reach certificate-authority administration and remote command execution on managed nodes.
Affected when
- Puppet Enterprise before 2023.8.13, before 2025.12.1, or before 2026.0.1
- A certificate authority issues a colliding certificate by approval or autosign
What to do
Update to 2023.8.13, 2025.12.1, or 2026.0.1 or later. Also check the vendor's advisory.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen