EUVD-2026-41516
GHSA-rh7m-r3xm-v5xg
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local filesystem read of cache requires high-privilege access; only confidentiality is impacted - no integrity or availability impact from this flaw alone.
Primary rating from Vendor (Perforce).
CVSS VectorVendor: Perforce
Lifecycle Timeline
1DescriptionCVE.org
Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sensitive flag on parameters defined via the resource-api, causing values such as passwords to be stored in cleartext in the agent's local transaction state cache. Affected versions of the resource_api module include all versions between 1.5.0 - 1.9.1 and 2.0.0 The issue was fixed in puppet resource_api 1.9.2 and 2.0.1 released with Puppet Core 8.20.0 and PE 2023.8.10 & PE 2025.11.0.
AnalysisAI
Cleartext storage of sensitive parameters in Puppet's resource_api module (versions 1.5.0-1.9.1 and 2.0.0) causes passwords and other credential values to persist unmasked in the Puppet agent's local transaction state cache. The sensitive flag - intended to prevent exactly this exposure - is silently dropped during resource_api parameter processing, meaning any resource type built on this API and declaring sensitive parameters leaks those values to the cache filesystem. No public exploit exists and this is not listed in CISA KEV, but the confidentiality impact is high for environments where Puppet manages secrets such as database passwords or API tokens.
Technical ContextAI
The Puppet resource_api is a Ruby gem providing a modern interface for authoring Puppet resource types. When a resource type schema declares a parameter with sensitive: true, Puppet is expected to wrap the value in a Puppet::Pops::Types::PSensitiveType::Sensitive object, which suppresses the value from appearing in logs, reports, and state caches. CVE-2026-8804 (CWE-313: Cleartext Storage of Sensitive Information) is a flag-propagation failure: the resource_api module drops the sensitive wrapper during its internal processing pipeline, allowing raw parameter values to be written unredacted into the agent's local transaction state cache (typically under /opt/puppetlabs/puppet/cache/ on Linux). This affects only resource types implemented via the resource_api interface; Puppet's older built-in type system is not impacted. Affected CPEs are cpe:2.3:a:perforce:puppet_core and cpe:2.3:a:perforce:puppet_enterprise, covering Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x.
RemediationAI
Upgrade to puppet resource_api 1.9.2 (for the 1.x line) or 2.0.1 (for the 2.x line), which are bundled with Puppet Core 8.20.0 and Puppet Enterprise 2023.8.10 or PE 2025.11.0 respectively. Full details are at https://portal.perforce.com/s/cve/a91Qi000003511lIAA/cve20268804-cleartext-storage-of-sensitive-information-for-puppet-resource-api. As a compensating control prior to patching, tighten filesystem permissions on the Puppet agent cache directory to restrict read access exclusively to the puppet service account and root, reducing the number of local users who can extract the cached values; note this does not prevent the cleartext write, only limits who can read it. After patching, rotate any credentials managed by resource_api-backed resource types that declared sensitive parameters, as those values may have been cached in cleartext during the exposure window.
Same weakness CWE-313 – Cleartext Storage in a File or on Disk
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today