Puppet resource_api CVE-2026-8804

Q: What is the CVSS score of CVE-2026-8804?

CVE-2026-8804 has a CVSS 4.0 base score of 6.7 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-41516 MEDIUM

Cleartext Storage in a File or on Disk (CWE-313)

2026-07-03 Perforce

GHSA-rh7m-r3xm-v5xg

Information Disclosure Red Hat Puppet Enterprise Puppet Core Perforce

6.7

CVSS 4.0 · Vendor: Perforce

Severity by source

Vendor (Perforce) PRIMARY

6.7 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.4 MEDIUM

Local filesystem read of cache requires high-privilege access; only confidentiality is impacted - no integrity or availability impact from this flaw alone.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

4.4 MEDIUM

qualitative

Primary rating from Vendor (Perforce).

CVSS VectorVendor: Perforce

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 08:21 vuln.today

DescriptionCVE.org

Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sensitive flag on parameters defined via the resource-api, causing values such as passwords to be stored in cleartext in the agent's local transaction state cache. Affected versions of the resource_api module include all versions between 1.5.0 - 1.9.1 and 2.0.0 The issue was fixed in puppet resource_api 1.9.2 and 2.0.1 released with Puppet Core 8.20.0 and PE 2023.8.10 & PE 2025.11.0.

AnalysisAI

Cleartext storage of sensitive parameters in Puppet's resource_api module (versions 1.5.0-1.9.1 and 2.0.0) causes passwords and other credential values to persist unmasked in the Puppet agent's local transaction state cache. The sensitive flag - intended to prevent exactly this exposure - is silently dropped during resource_api parameter processing, meaning any resource type built on this API and declaring sensitive parameters leaks those values to the cache filesystem. No public exploit exists and this is not listed in CISA KEV, but the confidentiality impact is high for environments where Puppet manages secrets such as database passwords or API tokens.

Technical ContextAI

The Puppet resource_api is a Ruby gem providing a modern interface for authoring Puppet resource types. When a resource type schema declares a parameter with sensitive: true, Puppet is expected to wrap the value in a Puppet::Pops::Types::PSensitiveType::Sensitive object, which suppresses the value from appearing in logs, reports, and state caches. CVE-2026-8804 (CWE-313: Cleartext Storage of Sensitive Information) is a flag-propagation failure: the resource_api module drops the sensitive wrapper during its internal processing pipeline, allowing raw parameter values to be written unredacted into the agent's local transaction state cache (typically under /opt/puppetlabs/puppet/cache/ on Linux). This affects only resource types implemented via the resource_api interface; Puppet's older built-in type system is not impacted. Affected CPEs are cpe:2.3:a:perforce:puppet_core and cpe:2.3:a:perforce:puppet_enterprise, covering Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x.

RemediationAI

Upgrade to puppet resource_api 1.9.2 (for the 1.x line) or 2.0.1 (for the 2.x line), which are bundled with Puppet Core 8.20.0 and Puppet Enterprise 2023.8.10 or PE 2025.11.0 respectively. Full details are at https://portal.perforce.com/s/cve/a91Qi000003511lIAA/cve20268804-cleartext-storage-of-sensitive-information-for-puppet-resource-api. As a compensating control prior to patching, tighten filesystem permissions on the Puppet agent cache directory to restrict read access exclusively to the puppet service account and root, reducing the number of local users who can extract the cached values; note this does not prevent the cleartext write, only limits who can read it. After patching, rotate any credentials managed by resource_api-backed resource types that declared sensitive parameters, as those values may have been cached in cleartext during the exposure window.