| Name | CVE-2026-8804 |
| Description | Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sensitive flag on parameters defined via the resource-api, causing values such as passwords to be stored in cleartext in the agent's local transaction state cache. Affected versions of the resource_api module include all versions between 1.5.0 - 1.9.1 and 2.0.0 The issue was fixed in puppet resource_api 1.9.2 and 2.0.1 released with Puppet Core 8.20.0 and PE 2023.8.10 & PE 2025.11.0. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 1141432 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| ruby-puppet-resource-api (PTS) | bookworm | 1.8.16-2 | vulnerable |
| trixie | 1.9.0-1 | vulnerable |
| forky, sid | 2.0.1-1 | fixed |
The information below is based on the following data on fixed versions.
Notes
[trixie] - ruby-puppet-resource-api <no-dsa> (Minor issue)
[bookworm] - ruby-puppet-resource-api <postponed> (Minor issue; local-only cleartext exposure, values land in the 0640 root-owned $vardir/state/transactionstore.yaml, and only for provider modules written against the Resource API that declare sensitive parameters)
https://github.com/puppetlabs/puppet-resource_api/pull/384
Fixed by: https://github.com/puppetlabs/puppet-resource_api/commit/87737def98e5b299fcd78b198159bca88be991e7 (v1.9.2)