CVE-2026-115731

How it works. Agents send a report to the server after each run. OpenVox's advisory says a crafted event in that report is deserialized and "gives direct code execution on the openvox-server," running as the puppet user. Two lines from the advisory matter most: "In configuration with autosign (which is common for enterprise deployment), this is an unauthenticated attack chain," because a certificate can be requested through the client enrollment endpoint, and "Code execution as puppet gives access to the CA signing key." OpenVox credits alain-neodyme.

What's affected.

• OpenVox Server up to 9.1.0 and 8.17.0, fixed in 9.2.0 and 8.18.0 (OpenVox advisory).
• OpenVox Agent up to 9.2.0 and 8.31.1, fixed in 9.3.0 and 8.32.0 (OpenVox advisory).
• OpenVoxDB: Vox Pupuli lists 9.2.0 and 8.18.0 as the versions to update to.
• Puppet Enterprise 2023.8.0 before 2023.8.13, 2025.0.0 before 2025.12.1 and 2026.0.0 before 2026.0.1, per Perforce's own CVE record as CNA. Perforce's advisory page would not load for us.
• Open Source Puppet: OpenVox's oss-security notice says the issue affects "all known OpenVox and Puppet versions and implementations," including "any repackaged or bundled usage," and that Puppet "will not be receiving security updates."

The test. An unpatched server is reachable by anyone who can reach its agent port with a signed certificate, or who can get one.

1. Check the version. rpm -q openvox-server or dpkg -l openvox-server, puppetserver --version on Puppet Server, and the PE version on Puppet Enterprise. Below the fixed versions, the server is in scope.
2. Check how certificates get signed. puppet config print autosign --section server. true or a broad autosign.conf glob means anyone who can reach the CA can get a certificate, the unauthenticated case OpenVox describes. A policy executable that checks a shared secret or cloud identity narrows it.
3. Check who can reach port 8140. Test from networks that shouldn't manage nodes, and list every compile server and CA server, not just the primary.
4. Inventory signed certificates. puppetserver ca list --all. Any valid agent certificate is enough to reach the bug.
5. Know where the CA key lives. puppet config print cadir --section server. If the CA runs on a server that processes reports, code execution there reaches the key, per the advisory.

Companion: CVE-2026-115732. A certificate-name authorization bypass fixed in the same OpenVox Server and OpenVoxDB releases and Puppet Enterprise builds; OpenVox's advisory gives the example that "a cert issued for evil.target.lab.local will match target.lab.local." Perforce's CVE record says that in Puppet Enterprise it can also grant access to certificate-authority administration and remote command execution on managed nodes. Perforce scores it 9.0 and OpenVox 9.5, both CVSS 4.0. After upgrading, Vox Pupuli advises validating custom auth.conf rules "to ensure that they're still working as you intended."

These come from Vox Pupuli's update post. Each works only under the condition at the end of its line.

• Delivery. Restrict the server so it is reachable only from "the network segments which require access." This only helps if no host inside those segments already holds a valid certificate or can get one.
• Delivery. "Disable or tighten access to autosign," for example by moving from true or a glob list to policy-based autosigning. This only helps if existing signed certificates are also reviewed, since any signed agent certificate can still reach the bug.
• Exploitation. In serverless setups, "disable OpenVoxDB access for individual nodes." This only helps if you run serverless OpenVox.
• Execution. OpenVox publishes standalone patch scripts for older versions, warning they "might or might not apply cleanly on old and outdated versions" and that mitigations "do not necessarily eliminate your risk." This only helps if the script applies cleanly on your exact version and you verify it.

Upgrading to OpenVox Server 9.2.0 or 8.18.0, or Puppet Enterprise 2023.8.13, 2025.12.1 or 2026.0.1, is the only fix.

Neither OpenVox nor Perforce has published detection guidance or indicators for CVE-2026-115731. The advisory's proof of concept sends a report to PUT /puppet/v3/report with a crafted __ptype event value; no vendor has published a detection rule based on it.

Am I exposed to CVE-2026-115731?

Yes, if you run OpenVox Server below 9.2.0 or 8.18.0, Puppet Enterprise below 2023.8.13, 2025.12.1 or 2026.0.1, or Open Source Puppet Server, and hosts with, or able to get, a signed agent certificate can reach port 8140.

Is CVE-2026-115731 being exploited?

No exploitation has been reported, and it is not on CISA KEV as of November 4, 2026. A working trigger payload is public in OpenVox's advisory.

Is there a patch?

Yes. OpenVox Server 9.2.0 and 8.18.0, OpenVox Agent 9.3.0 and 8.32.0, and Puppet Enterprise 2023.8.13, 2025.12.1 and 2026.0.1. OpenVox says Open Source Puppet will not get security updates and recommends migrating to OpenVox.

How do I mitigate CVE-2026-115731 without patching?

Limit port 8140 to the segments that need it and tighten autosign, per Vox Pupuli. These reduce exposure but are not a fix.

Nov 4, 2026. First published. Public trigger payload in OpenVox's advisory; no exploitation reported; not on CISA KEV.

• OpenVox advisory GHSA-ffr6-rwpm-p5wq
• OpenVox advisory GHSA-q4hm-33rc-572g (CVE-2026-115732)
• oss-security, OpenVox notice (Nov 3, 2026)
• Vox Pupuli, Critical CVE Updates (Nov 3, 2026)
• NIST NVD: CVE-2026-115731 (Perforce's CNA record; checked Nov 4) and CVE-2026-115732
• Perforce advisory (did not load for us)
• CISA Known Exploited Vulnerabilities catalog (checked Nov 4)