CVE-2026-8804: Cleartext Storage of Sensitive Information for Puppet Resource API
Puppet resourceapi (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sensitive flag on parameters defined via the resource-api, causing values such as passwords to be stored in cleartext in the agent's local transaction state cache. Affected versions of the resourceapi module include all versions between 1.5.0 - 1.9.1 and 2.0.0 The issue was fixed in puppet resourceapi 1.9.2 and 2.0.1 released with Puppet Core 8.20.0 and PE 2023.8.10 & PE 2025.11.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
puppet resource_apito a version that resolves this vulnerability.Fixed in 8.20.0 - Upgrade
Upgrade
puppet enterprise (PE) resource_apito a version that resolves this vulnerability.Fixed in 2023.8.10 - Upgrade
Upgrade
puppet enterprise (PE) resource_apito a version that resolves this vulnerability.Fixed in 2025.11.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8804?
The severity of CVE-2026-8804 is medium with a CVSS score of 6.7.
How can I fix CVE-2026-8804?
To fix CVE-2026-8804, update to a patched version of Puppet Core or Puppet Enterprise that addresses the cleartext storage issue.
What information is stored in cleartext due to CVE-2026-8804?
CVE-2026-8804 allows sensitive information, such as passwords, to be stored in cleartext in the agent's local transaction state cache.
What software is affected by CVE-2026-8804?
CVE-2026-8804 affects Puppet Resource API as shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x.
When was CVE-2026-8804 published?
CVE-2026-8804 was published on July 3, 2026.