CVE-2026-8804
Description
A flaw was found in Puppet resource_api. This vulnerability occurs because the resource-api does not properly preserve the sensitive flag on parameters. As a result, sensitive information, such as passwords, can be stored in cleartext within the agent's local transaction state cache. This could allow an attacker with access to the agent's cache to retrieve sensitive data.
Statement
Red Hat OpenStack Platform 17.1 ships rubygem-puppet-resource_api version 1.8.13, which is within the affected range (1.5.0-1.9.1). Red Hat Satellite ships puppet-agent which bundles the resource_api gem; investigation is ongoing to determine if those versions are in the affected range. The sensitive flag on resource_api parameters is not properly preserved, causing values such as passwords to be stored in cleartext in the Puppet agent's local transaction state cache.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.4 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | High | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
Storing a plaintext password in a configuration file allows anyone who can read the file to access the password-protected resource. In some contexts, even storage of a plaintext password in memory is considered a security risk if the password is not cleared immediately after it is used.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
