Puppet Core 9.1.3

Released in November 2026. This version of Puppet Core adds Puppet 9 compatibility for bundled core modules, includes improvements to help prevent security vulnerabilities, reduces CA certificate and CRL requests, improves macOS service management, fixes a scheduled agent crash on macOS 26 arm64, and resolves Puppet Resource API 2.x dependency conflicts.

New features and enhancements

Puppet 9 compatibility for core modules

The following core modules bundled with Puppet Core 9.1.3 are now compatible with Puppet 9, so you can use the updated modules with Puppet Core 9 as well as with Puppet Core 8.

PA-9117

Security updates

Fixed a certificate name authorization bypass vulnerability

Fixed an authorization bypass vulnerability (CVE-2026-115732) that could allow a managed machine to impersonate another machine when certificate names partially matched approved names. PA-9587

Fixed an arbitrary code execution vulnerability

Fixed CVE-2026-115731, a vulnerability that could allow arbitrary code execution on the Puppet Server host. PA-9473

Updated curl

Updated curl from 8.22.0 to 8.23.0 to address CVE-2026-92392. PA-9481

Updated OpenSSL

Updated OpenSSL from version 3.5.8 to version 3.5.9 to address the following security vulnerabilities in the OpenSSL 2026-09-29 advisory.

  • CVE-2026-35189

  • CVE-2026-35191

  • CVE-2026-42772

  • CVE-2026-54872

  • CVE-2026-54873

  • CVE-2026-54875

  • CVE-2026-72897

  • CVE-2026-75804

  • CVE-2026-75805

  • CVE-2026-75806

  • CVE-2026-77696

  • CVE-2026-84782

  • CVE-2026-84784

PA-9432

Resolved issues

Fewer CA certificate and CRL requests

When a CA certificate or CRL is unchanged, Puppet Agent now records that it checked for an update. This prevents requests on every agent run while preserving refresh requests after changes. PA-9480

Improved macOS launchd service management

On macOS, the Puppet Agent launchd provider now uses launchctl instead of writing property list files. This prevents service restart failures when the agent does not have Full Disk Access. PA-9475

Fixed scheduled Puppet Agent crashes on macOS 26

Fixed a crash that could occur when Puppet Agent ran as a launchd daemon on macOS 26 arm64 systems. Interactive runs were not affected. PA-9437

Fixed Puppet Resource API 2.x dependency conflicts

Previously, conflicting dependency requirements for puppet-resource_api 2.x in Puppet Core 9 components caused errors when running or testing against the API. The dependency issues have been resolved. Puppet Core 8 is unchanged. PA-9348