Read the docs
TI-2026-07740 Aliases CVE-2026-8804GHSA-rh7m-r3xm-v5xg

Cleartext Storage of Sensitive Information for Puppet Resource API

Priority LOW 28CWE-312Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-312.

Summary

Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sensitive flag on parameters defined via the resource-api, causing values such as passwords to be stored in cleartext in the agent's local transaction state cache. Affected versions of the resource_api module include all versions between 1.5.0 - 1.9.1 and 2.0.0 The issue was fixed in puppet resource_api 1.9.2 and 2.0.1 released with Puppet Core 8.20.0 and PE 2023.8.10 & PE 2025.11.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00107 1st percentileScored 2026-11-07
Fix Partial Puppet Core (Perforce): 8.20.0Puppet Enterprise (Perforce): 2023.8.10, 2025.11.0Red Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PerforcePuppet Core8.11.0 – 8.19.0; 8.0.0 – 8.10.08.20.0Patch availableCNA
PerforcePuppet Enterprise2023.8.0 – 2023.8.9; 2025.0.0 – 2025.10.02023.8.10, 2025.11.0Patch availableCNA
  • Puppet Core VendorPerforce Affected 8.11.0 – 8.19.0; 8.0.0 – 8.10.0 Fixed in 8.20.0 Patch available CNA
  • Puppet Enterprise VendorPerforce Affected 2023.8.0 – 2023.8.9; 2025.0.0 – 2025.10.0 Fixed in 2023.8.10, 2025.11.0 Patch available CNA

Remediation

  • Fix · CNA Puppet Core (Perforce) Fixed in 8.20.0
  • Fix · CNA Puppet Enterprise (Perforce) Fixed in 2023.8.10, 2025.11.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 17.1AffectedNo fix yet: Fix deferred
Red Hat Satellite 6AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-8804
  2. 2026-10-03 Alias added: GHSA-rh7m-r3xm-v5xg

References

Other 1

  • TI-2026-58853 Unauthenticated Remote Code Execution in Akana API Platform CVSS 4.0CRITICAL 10.0
  • TI-2026-71533 Perforce Helix Authentication Service ships a default SCIM token CVSS 4.0CRITICAL 9.3
  • TI-2026-05304 Insecure Default Configuration in P4 Server CVSS 4.0HIGH 8.8
  • TI-2015-07378 Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to… CVSS 3.1CRITICAL 9.8
  • TI-2007-00095 The Perforce client does not restrict the set of files that it overwrites upon receiving… CVSS 2.0HIGH 10.0
  • TI-2026-60410 XML External Entity in Akana API Platform CVSS 4.0CRITICAL 9.2
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences