CVE-2026-8804 Overview
CVE-2026-8804 is a cleartext storage vulnerability [CWE-312] in the Puppet resource_api module shipped with Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x. The resource_api fails to preserve the sensitive flag on parameters defined through the resource-api interface. As a result, values such as passwords and API tokens are written in cleartext to the agent's local transaction state cache. An attacker with local access to a Puppet-managed node can read secrets that administrators expected to be redacted. Affected resource_api versions include 1.5.0 through 1.9.1 and 2.0.0. Perforce fixed the issue in resource_api1.9.2 and 2.0.1, shipped with Puppet Core 8.20.0, PE 2023.8.10, and PE 2025.11.0.
Critical Impact
Secrets marked sensitive in Puppet manifests are persisted in cleartext in the agent's transaction state cache, exposing credentials to any local user or process able to read agent state files.
Affected Products
- Puppet resource_api versions 1.5.0 through 1.9.1
- Puppet resource_api version 2.0.0
- Puppet Core 8.x prior to 8.20.0 and Puppet Enterprise 2023.8.x prior to 2023.8.10, and 2025.x prior to 2025.11.0
Discovery Timeline
- 2026-07-03 - CVE-2026-8804 published to NVD
- 2026-07-06 - Last updated in NVD database
Technical Details for CVE-2026-8804
Vulnerability Analysis
The resource_api module provides an abstraction layer for authoring Puppet resource types and providers. Parameter definitions can carry a sensitive flag that instructs Puppet to redact values in logs, reports, and cached state. In the affected versions, the module drops or never propagates that flag through the transaction pipeline. Values flow into the agent's local state cache as plain strings.
The transaction state cache resides on each managed node and records the last observed values of resource parameters between runs. When cleartext secrets land in this file, they persist across agent restarts and are readable by any account with filesystem access to the cache directory. Backup jobs, log shippers, and forensic captures may propagate the exposure further.
Root Cause
The root cause is missing propagation of the sensitive attribute from the resource-api parameter definition into the serialized state written by the Puppet agent. Puppet's core type system honors the flag, but the resource-api shim did not carry it through. The fix restores flag preservation so redaction runs consistently before values are persisted.
Attack Vector
Exploitation requires local access to the managed node with sufficient privileges to read the Puppet agent's cache directory, typically under /opt/puppetlabs/puppet/cache/state/ on Linux or the equivalent path on Windows. A low-integrity local account cannot reach the file, but any user who can read agent state, including compromised service accounts or attackers who have already achieved a foothold, can extract credentials. Refer to the Perforce Security Advisory for CVE-2026-8804 for vendor technical details.
Detection Methods for CVE-2026-8804
Indicators of Compromise
- Presence of cleartext credential strings inside the Puppet agent transaction state cache (state.yaml, graphs/, last_run_report.yaml) on managed nodes.
- Unexpected reads of files under /opt/puppetlabs/puppet/cache/state/ by non-Puppet processes or interactive users.
- Copies of Puppet agent cache files appearing in backup archives, log aggregation pipelines, or attacker-staged directories.
Detection Strategies
- Inventory Puppet agents and query the installed resource_api gem version; flag hosts running 1.5.0–1.9.1 or 2.0.0.
- Scan agent state caches for high-entropy strings or known secret patterns that should have been redacted by the sensitive flag.
- Audit custom resource types authored against resource_api and confirm each declared sensitive parameter is redacted in the corresponding last_run_report.yaml.
Monitoring Recommendations
- Enable filesystem auditing (auditd, Windows Object Access) on the Puppet cache directory to record access by unexpected principals.
- Ship Puppet agent run reports to a central log store and alert when redacted values are missing for parameters known to be sensitive.
- Track deployments of Puppet Core and Puppet Enterprise versions against the fixed baselines to confirm remediation coverage.
How to Mitigate CVE-2026-8804
Immediate Actions Required
- Upgrade the resource_api module to 1.9.2 or 2.0.1 on every Puppet agent and server.
- Upgrade to Puppet Core 8.20.0, Puppet Enterprise 2023.8.10, or Puppet Enterprise 2025.11.0, which bundle the fixed module.
- Rotate every credential, token, or key that was previously passed through a resource_api-defined sensitive parameter, since prior values may already be on disk.
- Purge existing agent state caches after upgrade so historical cleartext values do not linger.
Patch Information
Perforce released fixes in resource_api1.9.2 and 2.0.1, shipped with Puppet Core 8.20.0, Puppet Enterprise 2023.8.10, and Puppet Enterprise 2025.11.0. See the Perforce Security Advisory for CVE-2026-8804 for the authoritative advisory and download locations.
Workarounds
- Restrict filesystem permissions on the Puppet agent cache directory so only the Puppet service account can read state files, reducing exposure until patches are deployed.
- Avoid managing high-value secrets through resource_api-based custom types on affected versions; source those values from an external secrets store such as Hiera-eyaml or HashiCorp Vault and pass them at runtime.
- Exclude Puppet agent cache paths from backup sets and log-shipping pipelines that would broaden the disclosure footprint.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
