Source: ruby-puppet-resource-api Version: 1.9.0-1 Severity: important Tags: security upstream Forwarded: https://github.com/puppetlabs/puppet-resource_api/pull/384 X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for ruby-puppet-resource-api. CVE-2026-8804[0]: | Puppet resource_api (shipped in Puppet Core 8.x and Puppet | Enterprise 2023.8.x and 2025.x) does not preserve the sensitive flag | on parameters defined via the resource-api, causing values such as | passwords to be stored in cleartext in the agent's local transaction | state cache. Affected versions of the resource_api module include | all versions between 1.5.0 - 1.9.1 and 2.0.0 The issue was fixed in | puppet resource_api 1.9.2 and 2.0.1 released with Puppet Core 8.20.0 | and PE 2023.8.10 & PE 2025.11.0. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-8804 https://www.cve.org/CVERecord?id=CVE-2026-8804 [1] https://github.com/puppetlabs/puppet-resource_api/pull/384 [2] https://github.com/puppetlabs/puppet-resource_api/commit/87737def98e5b299fcd78b198159bca88be991e7 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
