Medium WID-SEC-2026-2206 1 CVE

Puppet: Schwachstelle ermöglicht Offenlegung von Informationen

Published Jul 5, 2026 · Updated Jul 5, 2026 · de-DE

Vendor: Puppet Product: Puppet Platform: Linux Platform: Windows

Summary

Ein lokaler Angreifer kann eine Schwachstelle in Puppet ausnutzen, um Informationen offenzulegen.

Product

Puppet ist ein Werkzeug für das System-Management - es soll das Configuration Management zentralisieren und automatisieren.

Vulnerabilities 1

Medium 6.7

CVE-2026-8804

Cleartext Storage of Sensitive Information for Puppet Resource API

Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sensitive flag on parameters defined via the resource-api, causing values such as passwords to be stored in cleartext in the agent's local transac…

Perforce Puppet Enterprise Puppet Core ruby-puppet-resource-api Debian Ubuntu

Jul 3, 2026

Revision history

2026-07-05 #1
Initiale Fassung

References

GitHub Advisory Database vom 2026-07-05
https://github.com/advisories/GHSA-RH7M-R3XM-V5XG
Perforce Advisory vom 2026-07-05
https://portal.perforce.com/s/cve/a91Qi000003511lIAA/cve20268804-cleartext-storage-of-sensitive-information-for-puppet-resource-api