CVE•Published 2026-07-03•Modified 2026-07-06•0 articles on news•5 live references•NVD data

CVE-2026-8804

Vulnerability data via NVD (ingested)

CVSS v3.1

—

EPSS percentile

Exploit Prediction Scoring System · top 100% of all CVEs

Weaknesses (CWE)

CWE-312Cleartext Storage of Sensitive Information CWE-313Cleartext Storage in a File or on Disk

Description

Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sensitive flag on parameters defined via the resource-api, causing values such as passwords to be stored in cleartext in the agent's local transaction state cache. Affected versions of the resource_api module include all versions between 1.5.0 - 1.9.1 and 2.0.0 The issue was fixed in puppet resource_api 1.9.2 and 2.0.1 released with Puppet Core 8.20.0 and PE 2023.8.10 & PE 2025.11.0.

Timeline

Published 2026-07-03

Modified 2026-07-06

External references

NVD MITRE Exploit-DB trickest/cve VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).

Shodan · vuln tag0 hosts

vuln:CVE-2026-8804

Hosts Shodan has explicitly fingerprinted as vulnerable.

More intel sources (5)

Shodan report

vuln:CVE-2026-8804

Country / ASN / product breakdown for the vuln query.

Censys

vulnerabilities.cve_id: CVE-2026-8804

Censys host search filtered to this CVE id.

grep.app

CVE-2026-8804