Vulnerability · Published Jul 3, 2026 · Assigned by Perforce
CVE-2026-8804Cleartext Storage of Sensitive Information for Puppet Resource API
Medium 6.7
In plain English
A medium-severity security flaw in Puppet Core from Perforce. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sensitive flag on parameters defined via the resource-api, causing values such as passwords to be stored in cleartext in the agent's local transaction state cache. Affected versions of the resource_api module include all versions between 1.5.0 - 1.9.1 and 2.0.0 The issue was fixed in puppet resource_api 1.9.2 and 2.0.1 released with Puppet Core 8.20.0 and PE 2023.8.10 & PE 2025.11.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | ruby-puppet-resource-api | no fix listed | DEBIAN-CVE-2026-8804 |
| Debian:13 | ruby-puppet-resource-api | no fix listed | DEBIAN-CVE-2026-8804 |
| Debian:14 | ruby-puppet-resource-api | 2.0.1-1 | DEBIAN-CVE-2026-8804 |
| Ubuntu:24.04:LTS | ruby-puppet-resource-api | no fix listed | UBUNTU-CVE-2026-8804 |
| Ubuntu:25.10 | ruby-puppet-resource-api | no fix listed | UBUNTU-CVE-2026-8804 |
| Ubuntu:26.04:LTS | ruby-puppet-resource-api | no fix listed | UBUNTU-CVE-2026-8804 |
| Ubuntu:26.10 | ruby-puppet-resource-api | no fix listed | UBUNTU-CVE-2026-8804 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Perforce | Puppet Core | 8.11.0 – through 8.19.08.0.0 – through 8.10.0 |
| Perforce | Puppet Enterprise | 2023.8.0 – through 2023.8.92025.0.0 – through 2025.10.0 |
Weakness: CWE-313, CWE-312 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:L