CVE-2026-8804

Cleartext Storage of Sensitive Information for Puppet Resource API

6.7 MediumFix available

CVE-2026-8804 is a medium vulnerability (CVSS 6.7) in Perforce Puppet Core, published July 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.11%, the 1st percentile. Fixed in ruby-puppet-resource-api 2.0.1-1.

Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sensitive flag on parameters defined via the resource-api, causing values such as passwords to be stored in cleartext in the agent's local transaction state cache. Affected versions of the resource_api module include all versions between 1.5.0 - 1.9.1 and 2.0.0 The issue was fixed in puppet resource_api 1.9.2 and 2.0.1 released with Puppet Core 8.20.0 and PE 2023.8.10 & PE 2025.11.0.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.11%Unchanged since Jul 4, 2026

What each source reports

CVE List Score used 6.7

Cleartext Storage of Sensitive Information for Puppet Resource API

Record: CVE-2026-8804
CVSS 4.0: 6.7 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:L
Weakness: CWE-313, CWE-312
Updated: 2026-11-02

EUVDEUVD-2026-41516 6.7

Record: EUVD-2026-41516
CVSS 4.0: 6.7 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-rh7m-r3xm-v5xg 6.7

Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does...

Record: GHSA-rh7m-r3xm-v5xg
CVSS 4.0: 6.7 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-312
Updated: 2026-11-02

NVD 6.7

Record: CVE-2026-8804
CVSS 4.0: 6.7 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-312, CWE-313
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-8804 6.7

Record: DEBIAN-CVE-2026-8804
CVSS 4.0: 6.7 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-8804 6.7

Record: UBUNTU-CVE-2026-8804
CVSS 4.0: 6.7 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:L
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`ruby-puppet-resource-api` Debian:12	All versions, plus listed versions 1.8.16-21.9.0-12.0.1-1	None known
`ruby-puppet-resource-api` Debian:13	All versions, plus listed versions 1.9.0-12.0.1-1	None known
`ruby-puppet-resource-api` Debian:14	before 2.0.1-1, plus listed versions 1.9.0-1	2.0.1-1
`ruby-puppet-resource-api` Ubuntu:24.04:LTS	All versions, plus listed versions 1.8.16-21.9.0-1	None known
`ruby-puppet-resource-api` Ubuntu:25.10	All versions, plus listed versions 1.9.0-1	None known
`ruby-puppet-resource-api` Ubuntu:26.10	All versions, plus listed versions 1.9.0-12.0.1-1	None known
`ruby-puppet-resource-api` Ubuntu:26.04:LTS	All versions, plus listed versions 1.9.0-1	None known

History

History
When	Changed	Sources
2026-11-02	created	CVE List, EUVD, GitHub Advisories, NVD, OSV