PoC exposes critical remote code flaw in Puppet Server

SecurityOnline[.]info reports that a full PoC exploit for CVE-2026-115731, a critical Puppet Server RCE flaw rated CVSS 9.4, has been published. The OpenVox project’s GitHub advisory and a write‑up from Neodyme confirm that a crafted JSON report can trigger code execution on the server when processing a serialized Ruby object, potentially enabling an attacker to run arbitrary commands with the puppet user.

The advisory notes that the server trusts a type name supplied by the attacker, reaching a Ruby class_eval call. A second issue, CVE-2026-115732 (CVSS 9.0), involves certificate name impersonation, which Perforce says can lead to remote command execution on managed nodes in Puppet Enterprise. The article adds that a container image flaw in openvoxdb could let any certificate access the API in that context. The researchers and vendors disclosed the bugs on 3 November 2026; the PoC exploit itself is publicly available, raising the urgency for remediation.

The piece lists affected products and versions, including OpenVox Server 9.1.0 and below, 8.17.0 and below; OpenVox Agent 9.2.0 and below, 8.31.1 and below; Puppet Enterprise before 2023.8.13, 2025.12.1, and 2026.0.1; and Open Source Puppet, which will not receive updates. The recommended patches are to OpenVox Agent 8.32.0 or 9.3.0, OpenVox Server 8.18.0 or 9.2.0, openvoxdb 8.18.0 or 9.2.0 (including the container image), and Puppet Enterprise 2023.8.13, 2025.12.1 or 2026.0.1.

The advisory emphasises patching as the primary defence, with further caution to tighten autosign and review auth.conf rules after upgrading. No exploitation in the wild has been confirmed at the time of reporting.