CVE-2026-8804
Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sensitive flag on parameters defined via the resource-api, causing values such as passwords to be stored in cleartext in the agent's local transaction state cache. Affected versions of the resource_api module include all versions between 1.5.0 - 1.9.1 and 2.0.0 The issue was fixed in puppet resource_api 1.9.2 and 2.0.1 released with Puppet Core 8.20.0 and PE 2023.8.10 & PE 2025.11.0.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.7
- CVSS vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:L
- EPSS probability
- 0.11%
- CWE
- CWE-313, CWE-312
- Published
- 2026-07-03
- Last modified
- 2026-07-06
Affected products
- Perforce Puppet Core
- Perforce Puppet Core
- Perforce Puppet Core
- Perforce Puppet Enterprise
- Perforce Puppet Enterprise
- Perforce Puppet Enterprise
- Perforce Puppet Enterprise
Weakness type
Related vulnerabilities
- CVE-2026-14663 — PostgreSQL pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext
- CVE-2026-52783 — OpenProject: Information Disclosure (cleartext storage of data) on localhost through memcached via Others "storage.<id>.httpx_access_token" leads to Sensitive Data Exposure
- CVE-2026-24349 — A vulnerability has been identified in SIMATIC WinCC Unified PC Runtime V16 (All versions), SIMATIC...
- CVE-2025-4397 — Medtronic MyCareLink Patient Monitor Data Encryption Weakness
- CVE-2026-6796 — Sanluan PublicCMS Failed Login LoginAdminController.java log_login cleartext storage in file
- CVE-2026-6598 — langflow-ai langflow Project Creation Endpoint projects.py encrypt_auth_settings cleartext storage in file
- CVE-2026-5531 — SourceCodester Student Result Management System HTTP GET Request login_credentials.txt cleartext storage in file
- CVE-2025-64305 — Columbia Weather Systems MicroServer Cleartext Storage in a File or on Disk