CVE WatchNov 3, 2026

CVE-2026-115732

Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products,

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Nov 3, 2026 · Last modified: Nov 3, 2026 · CWE-697 · CWE-863

EPSS · 30d

Not enough EPSS history yet.

Technical description

Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products, allows a client that holds a CA-signed certificate whose name extends or shortens an authorized hostname to be authorized as that host. This enables impersonation of other nodes and, in Puppet Enterprise, access to certificate-authority administration and remote command execution on managed nodes. Exploitation requires a certificate with a colliding name, which the certificate authority issues by approval or autosign.

Official references

portal.perforce.comhttps://portal.perforce.com/s/cve/a91Qi000003IaJRIA0/certificate-name-authorization-bypass

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-921918.8 HIG

—

———Quest Foglight for Databases runScript Incorrect Authorization Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The specific flaw exists within the runScript function. The issue results from incorrect authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29192.8h CVE-2026-1166674.2 MED

—

———Tanium addressed an improper access controls vulnerability in Discover.9h CVE-2026-1166643.1 LOW

—

———Tanium addressed an improper access controls vulnerability in Discover.9h CVE-2026-1166616.5 MED

—

———Tanium addressed an improper access controls vulnerability in Enforce.9h CVE-2026-121541—

—

———In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition that builds multiple targets together may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, filesystem paths from some targets are not verified against the approved entitlements. Users who run untrusted Bake definitions may be affected. The issue is fixed in v0.38.1.9h CVE-2026-120930—

—

———Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)9h