CVE-2026-8804

Cleartext Storage of Sensitive Information for Puppet Resource API

State: Published
Severity: 6.7 Medium
Published: Jul 3, 2026
Updated: Jul 6, 2026
Reserved: May 18, 2026

Description

Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sensitive flag on parameters defined via the resource-api, causing values such as passwords to be stored in cleartext in the agent's local transaction state cache. Affected versions of the resource_api module include all versions between 1.5.0 - 1.9.1 and 2.0.0 The issue was fixed in puppet resource_api 1.9.2 and 2.0.1 released with Puppet Core 8.20.0 and PE 2023.8.10 & PE 2025.11.0.

Scores

CVSS	Score	Vector	Source
4.0	6.7 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:L	Perforce

Weaknesses

CWE-313 Cleartext storage in a file or on disk
CWE-312 Cleartext storage of sensitive information

Affected Products

Product	Versions
Puppet CorePerforce	8.11.0 through 8.19.0Affected 8.0.0 through 8.10.0Affected 8.20.0Not affected
Puppet EnterprisePerforce	2023.8.0 through 2023.8.9Affected 2025.0.0 through 2025.10.0Affected 2023.8.10Not affected 2025.11.0Not affected

References

https://portal.perforce.com/s/cve/a91Qi000003511lIAA/cve20268804-cleartext-storage-of-sensitive-information-for-puppet-resource-api

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.