Description
Deserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA-signed agent certificate to execute arbitrary code on the Puppet Server as its service user by submitting a report containing a crafted rich-data type via PUT request. Where the certificate authority autosigns requests without strong verification, an unauthenticated network attacker can obtain such a certificate.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Perforce | Puppet Enterprise | 2023.8.0 – < 2023.8.13, 2025.0.0 – < 2025.12.1, 2026.0.0 – < 2026.0.1 | 2023.8.13 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | puppet-agent | 8.10.0-5+deb13u1 | — |
| Debian 12 | puppet-agent | 7.23.0-1+deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | puppet | No fix yet | — |
| Ubuntu 20.04 LTS | puppet | No fix yet | — |
| Ubuntu 18.04 LTS | puppet | No fix yet | — |
| Ubuntu 14.04 LTS | puppet | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | puppet | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Capsule 6 | openvox-agent | 8.32.0-1.el9sat | RHSA-2026:95652 |
| Red Hat Satellite Capsule 6 | openvox-server | 8.18.0-1.el9sat | RHSA-2026:95652 |
| Red Hat Satellite 6 | openvox-agent | 8.32.0-1.el9sat | RHSA-2026:95652 |
| Red Hat Satellite 6 | openvox-server | 8.18.0-1.el9sat | RHSA-2026:95652 |
| Red Hat Rhel Satellite Openvox 6 | openvox-agent | 8.32.0-1.el7sat | RHSA-2026:95653 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | puppet | No fix yet | — |
Advisories 2
- RHSA-2026:95652 Red Hat Security Advisory: Satellite 6.19 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:95653 Red Hat Security Advisory: Satellite 6 Client Update Red Hat Security Advisories (RHSA) · Nov 13, 2026