Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-8804
PUBLISHED
More InfoOfficial Page
Assigner-Perforce
Assigner Org ID-ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e
View Known Exploited Vulnerability (KEV) details
Published At-03 Jul, 2026 | 07:40
Updated At-03 Jul, 2026 | 07:43
Rejected At-
▼CVE Numbering Authority (CNA)
Cleartext Storage of Sensitive Information for Puppet Resource API

Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sensitive flag on parameters defined via the resource-api, causing values such as passwords to be stored in cleartext in the agent's local transaction state cache. Affected versions of the resource_api module include all versions between 1.5.0 - 1.9.1 and 2.0.0 The issue was fixed in puppet resource_api 1.9.2 and 2.0.1 released with Puppet Core 8.20.0 and PE 2023.8.10 & PE 2025.11.0.

Affected Products
Vendor
Perforce Software, Inc.Perforce
Product
Puppet Core
Modules
  • puppet resource_api
Default Status
unaffected
Versions
Affected
  • From 8.11.0 through 8.19.0 (custom)
  • From 8.0.0 through 8.10.0 (custom)
Unaffected
  • 8.20.0 (custom)
Vendor
Perforce Software, Inc.Perforce
Product
Puppet Enterprise
Modules
  • puppet resource_api
Default Status
unaffected
Versions
Affected
  • From 2023.8.0 through 2023.8.9 (custom)
  • From 2025.0.0 through 2025.10.0 (custom)
Unaffected
  • 2023.8.10 (custom)
  • 2025.11.0 (custom)
Problem Types
TypeCWE IDDescription
CWECWE-313CWE-313 Cleartext storage in a file or on disk
CWECWE-312CWE-312 Cleartext storage of sensitive information
Type: CWE
CWE ID: CWE-313
Description: CWE-313 Cleartext storage in a file or on disk
Type: CWE
CWE ID: CWE-312
Description: CWE-312 Cleartext storage of sensitive information
Metrics
VersionBase scoreBase severityVector
4.06.7MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:L
Version: 4.0
Base score: 6.7
Base severity: MEDIUM
Vector:
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:L
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Upgrade to Puppet Core 8.20.0, PE 2023.8.10, or PE 2025.11.0

Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://portal.perforce.com/s/cve/a91Qi000003511lIAA/cve20268804-cleartext-storage-of-sensitive-information-for-puppet-resource-api
N/A
Hyperlink: https://portal.perforce.com/s/cve/a91Qi000003511lIAA/cve20268804-cleartext-storage-of-sensitive-information-for-puppet-resource-api
Resource: N/A
Details not found