{"id":"CVE-2026-115732","published":"2026-11-03T21:17:02.033","lastModified":"2026-11-03T21:17:02.033","description":"Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products, allows a client that holds a CA-signed certificate whose name extends or shortens an authorized hostname to be authorized as that host. This enables impersonation of other nodes and, in Puppet Enterprise, access to certificate-authority administration and remote command execution on managed nodes. Exploitation requires a certificate with a colliding name, which the certificate authority issues by approval or autosign.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-697","CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://portal.perforce.com/s/cve/a91Qi000003IaJRIA0/certificate-name-authorization-bypass","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}