PE 2023.8.13

Released November 2026

Puppet Enterprise (PE) 2023.8.13 delivers security, platform support, and reliability improvements, including stricter authorization rule matching, support for Oracle Linux 10 x86_64 agents, and fixes for orchestration workflows, CD4PE job execution, and certificate trust store updates. This release also includes fixes for multiple security vulnerabilities.

Puppet Enterprise® lifecycle update

Starting in August 2026, Puppet Enterprise transitioned its software support model from Long-Term Support (LTS) and Short-Term Support (STS) to the Latest and Latest-1 model. This change applies to both PE and PE Advanced. To learn more, see Puppet Enterprise Platform Support Lifecycle.

Puppet Enterprise (PE) 2023.8.x is the final release series under Puppet Enterprise's Long-Term Support (LTS) model. Future major releases follow the Latest / Latest - 1 support model introduced with PE 2026.0.
To access the release notes for the Puppet® platform, including Puppet agent, Puppet Server, Facter, and PuppetDB, see Platform release notes.

Enhancements

Authorization rules now use stricter certificate name matching

Authorization rules in auth.conf now match certificate names more strictly. Rules that specify a hostname match only certificates with that exact name. Wildcard rules such as *.example.com now match only names under example.com and no longer match example.com itself. If you rely on a wildcard rule to allow the bare domain, add a separate rule for that domain name.

Platform support

Agent platforms added

This release adds support for the Puppet agent on the following operating system platforms:

  • Oracle Linux 10 x86_64

Resolved issues

Daily log rotation no longer interrupts running plans

In previous PE versions, daily log rotation could restart the pe-plan-runner service while a plan was running. This caused orchestrated plans to abort before completion and could affect infrastructure workflows such as replica upgrades. This issue is resolved in PE 2026.0.1, 2025.12.1 and 2023.8.13 [PE-47319]

CD4PE jobs no longer fail with Puppet agent 9.1.1

In PE 2026.0.0, cd4pe_jobs module version 1.7.5 could fail when running jobs with Puppet agent 9.1.1 due to a missing dependency. As a result, repository and script payloads could fail to decompress, causing job execution to fail with an uninitialized constant GZipHelper::FileUtils error. This issue is resolved in PE 2026.0.1, 2025.12.1 and 2023.8.13. [PE-47501]

Updated trust stores remove revoked certificate authorities

PE now includes updated certificate trust stores that remove the compromised eMudhra intermediate CA certificates from the bundled trust chain. In addition, PE components that use the Go runtime have been updated to incorporate the latest certificate validation protections. These changes are included in PE 2026.0.1, 2025.12.1, and 2023.8.13. [PE-47591]

Security fixes

The following CVEs were fixed in PE:

  • CVE-2026-17508

  • CVE-2026-18036

  • CVE-2026-18040

  • CVE-2026-71888

  • CVE-2026-71889

  • CVE-2026-71891

  • CVE-2026-71892

  • CVE-2026-97873

  • CVE-2026-54904

  • CVE-2026-54905

  • CVE-2026-54906

  • CVE-2026-115731

  • CVE-2026-115732

  • CVE-2026-97629

  • CVE-2026-93479

  • CVE-2026-97205

  • CVE-2026-15176

  • CVE-2026-95101