{
  "cveId": "CVE-2026-8804",
  "url": "https://patchblox.com/security/cve/CVE-2026-8804",
  "summary": "CVE-2026-8804 is fixed in ruby-puppet-resource-api on 1 platform by DEBIAN-CVE-2026-8804 (version 2.0.1-1), released July 31, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "ruby-puppet-resource-api: Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sens...",
  "description": "Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sensitive flag on parameters defined via the resource-api, causing values such as passwords to be stored in cleartext in the agent\u0027s local transaction state cache. Affected versions of the resource_api module include all versions between 1.5.0 - 1.9.1 and 2.0.0 The issue was fixed in puppet resource_api\u00A01.9.2 and 2.0.1 released with Puppet Core 8.20.0 and PE 2023.8.10 \u0026 PE 2025.11.0.",
  "published": "2026-07-03T08:16:25Z",
  "severity": "",
  "epss": 0.00107,
  "epssPercentile": 0.01151,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "ruby-puppet-resource-api",
      "release": "Debian 14",
      "fixedVersion": "2.0.1-1",
      "fix": "DEBIAN-CVE-2026-8804",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-8804",
      "released": "2026-07-31T14:18:19Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}