Cyber ·
OpenVox Server: RCE and client identity spoofing vulnerabilities
Advisory from the OpenVox project on two vulnerabilities, remote code execution and client identity spoofing, which the source rates as 9+ CVE. Updates fix OpenVox and Puppet deployments.
On November 3, 2026, Ben Ford of the OpenVox project posted to the oss-sec feed an advisory about two vulnerabilities rated 9+ CVE. One allows remote code execution (RCE) and the other allows client identity spoofing. According to the source, the flaws affect all known versions and implementations of OpenVox and Puppet, including self-hosted infrastructure and uses repackaged or integrated into other products. Fixed versions, or later, are: openvox-agent 9.3.0 and 8.32.0; openvox-server 9.2.0 and 8.18.0; openvoxdb 9.2.0 and 8.18.0. The text available in Radar is an automatic translation and is truncated, so it gives no further details on attack vectors, exploitation conditions or temporary mitigations. To verify, consult the original advisory named in the source, on the oss-sec feed, and the official OpenVox release notes. Relevance to Rota Nacional: the advisory does not involve the Rota Nacional platform or its AI services, and Rota does not patch, monitor or replace OpenVox or Puppet. If your organization uses these products, the action is to update the listed components and check the installed versions.
Original source: OpenVox Server: vulnerabilidades de RCE e falsificação de identidade de cliente