CVE-2026-8804mediumCWE-312CWE-313

CVE-2026-8804: falha de média gravidade em Perforce Puppet Core

Cleartext Storage of Sensitive Information for Puppet Resource API

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Puppet Enterprise+ Monitorar Puppet Core

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.7epss 0.1%
Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sensitive flag on parameters defined via the resource-api, causing values such as passwords to be stored in cleartext in the agent's local transaction state cache. Affected versions of the resource_api module include all versions between 1.5.0 - 1.9.1 and 2.0.0 The issue was fixed in puppet resource_api 1.9.2 and 2.0.1 released with Puppet Core 8.20.0 and PE 2023.8.10 & PE 2025.11.0.
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:L
Produtos afetados
Perforce · Puppet CorePerforce · Puppet Enterprise
CVEs relacionadas — Perforce Puppet Core

No mesmo produto, das mais perigosas para as menos.

CVE-2025-5459HIGHOS Command InjectionEPSS 1.1%CVE-2026-115732CRITICALCertificate Name Authorization BypassEPSS 0.7%CVE-2026-115731CRITICALReport Deserialization Code ExecutionEPSS 0.4%CVE-2025-10360MEDIUMInsufficiently Protected Credentials in Puppet Enterprise 2025.4 and 2025.5EPSS 0.2%