Search: CVE-2026-115731

CVE-2026-115731 is a critical deserialization vulnerability in the report-processing code of Puppet Enterprise as used by Puppet Server. It allows a client with any CA-signed agent certificate to execute arbitrary code on the Puppet Server by submitting a specially crafted report via a PUT request. If the certificate authority autosigns requests without strong verification, an unauthenticated network attacker can obtain such a certificate and exploit this flaw.