Puppet Resource API Cleartext Storage Sensitive Info Vulnerability (CVE-2026-8804) Advisory

Vulnerability Overview CVE Number: CVE-2026-8804 Vulnerability Name: Cleartext Storage of Sensitive Information for Puppet Resource API Description: In Puppet Core 8.x and Puppet Enterprise 2023.8 and 2025.x, the fails to preserve sensitive flags, causing parameters (such as passwords) to be stored in plaintext in the agent's local transaction state cache. Affected Versions Affected Software Versions: - gem versions 1.5.0 - 1.9.1 and 2.0.0 - Puppet Core 8.1.10 - 8.19.0 and Puppet Core (Open Source) 8.0.0 - 8.10.0 - PE 2023.8.0 - 2023.8.9 and PE 2025.0.0 - 2025.10.0 Remediation Fixed Versions: - gem versions 1.9.2 and 2.0.1 - Puppet Core 8.20.0 - PE 2023.8.10 and PE 2025.11.0 Additional Information CVSS Score: 6.7 CVSS Base Score: 6.7 Report Date: 5/12/2026 Resolution Date: 6/26/2026 CVSS Link: https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VH:H/VI:N/VA:N/SC:N/SI:N/SA:L Footer Information Still need help? We're here. Tell us what you need and we'll try to help. Log a case Legal Information Copyright © 2025 Perforce. All rights reserved. Terms of Use - Privacy Policy Perforce and other identified trademarks are the property of Perforce Software, Inc., or one of its affiliates. Such trademarks are claimed and/or registered in the U.S. and other countries and regions. All third-party trademarks are the property of their respective holders. References to third-party trademarks do not imply endorsement or sponsorship of any products or services by the trademark holder. Contact Perforce Software, Inc., for further details.

Goal Reached Thanks to every supporter — we hit 100%!

Puppet Resource API Cleartext Storage Sensitive Info Vulnerability (CVE-2026-8804) Advisory