Pulling the right strings for RCE on a Puppet
Summary
Neodyme reveals two critical Puppet vulnerabilities with CVSS 9+ that enable RCE on the Puppet Server and host impersonation, disclosed responsibly to Perforce and OpenVox with patches released by Nov 3, 2026. The write-up details exploitation paths, affected versions (Puppet Enterprise 2025.11.2 and Puppet Core 6.24.0+), and the risk of attackers obtaining CA keys for impersonation and lateral movement. It also discusses the role of autosign, the disclosure timeline, and defensive strategies for enterprises using Puppet in production.