Two Critical Puppet bugs are fixed, and your autosign config decides how exposed you were
CVE-2026-115731 (CVSS 4.0 9.4) lets anyone holding a CA-signed agent certificate run code on the Puppet Server by submitting a crafted report, and autosign without strong verification turns that into an unauthenticated chain. CVE-2026-115732 (9.0) accepts a certificate whose name extends or shortens an authorised hostname as that host. OpenVox patched on 3 November with server 9.2.0 and 8.18.0 and agent 9.3.0 and 8.32.0; the NVD records carry Perforce's Puppet Enterprise ranges, and nothing collected shows exploitation in the wild.