PT-2026-55507 · Puppet · Puppet Core+2
CVE-2026-8804
·
Published
2026-07-03
·
Updated
2026-07-06
CVSS v4.0
6.7
Medium
| Vector | AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
resource api versions 1.5.0 through 1.9.1
resource api version 2.0.0
Puppet Core versions prior to 8.20.0
Puppet Enterprise 2023.8 versions prior to 2023.8.10
Puppet Enterprise 2025 versions prior to 2025.11.0
Description
The resource api does not preserve the sensitive flag on parameters defined via the resource-api. This failure results in sensitive values, such as passwords, being stored in cleartext within the agent's local transaction state cache.
Recommendations
Update resource api to version 1.9.2 or 2.0.1.
Update Puppet Core to version 8.20.0.
Update Puppet Enterprise 2023.8 to version 2023.8.10.
Update Puppet Enterprise 2025 to version 2025.11.0.
Fix
Cleartext Storage of Sensitive Information
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Puppet Core
Puppet Enterprise
Resource Api