CVE-2026-8804: Cleartext Storage of Sensitive Information for Puppet Resource API
Perforce · Puppet Core
Vendor fix available · Affected: Perforce Puppet Core · Exploitation: unlikely (under 1%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 1% of scored CVEs
DescriptionCVE.org
Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sensitive flag on parameters defined via the resource-api, causing values such as passwords to be stored in cleartext in the agent's local transaction state cache. Affected versions of the resource_api module include all versions between 1.5.0 - 1.9.1 and 2.0.0 The issue was fixed in puppet resource_api 1.9.2 and 2.0.1 released with Puppet Core 8.20.0 and PE 2023.8.10 & PE 2025.11.0.
Affected products2
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- Perforce · Puppet Corefrom 8.11.0 up to and including 8.19.0; from 8.0.0 up to and including 8.10.0
- Perforce · Puppet Enterprisefrom 2023.8.0 up to and including 2023.8.9; from 2025.0.0 up to and including 2025.10.0
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
CoverageNo articles yet
No CyberSIXT article names CVE-2026-8804 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.