PE 2025.12.0

Released October 2026

Puppet Enterprise (PE) 2025.12.0 expands platform support and introduces enhancements to Certificate Authority (CA) management and security. This release also improves patching and platform reliability, and includes fixes for multiple security vulnerabilities.

Puppet Enterprise^® lifecycle update

Starting in August 2026, Puppet Enterprise transitioned its software support model from Long-Term Support (LTS) and Short-Term Support (STS) to the Latest and Latest-1 model. This change applies to both PE and PE Advanced. To learn more, see Puppet Enterprise Platform Support Lifecycle.

Enhancements

Certificate Authority now limits pending certificate signing requests

Puppet Enterprise now limits the number of pending certificate signing requests (CSRs) that Puppet Server accepts, helping protect Certificate Authority (CA) infrastructure from disk-fill denial-of-service attacks caused by unauthenticated CSR flooding. By default, Puppet Server accepts up to 50,000 pending CSRs. When the limit is reached, requests for new certificate subjects receive an HTTP 503 response until existing pending CSRs are signed or removed.

CA storage migration: Added safety checks for --cleanup-fs

The puppetserver ca storage --cleanup-fs command now verifies that the active CA storage backend is database before archiving and deleting the CA directory. The command exits with an error if the backend cannot be confirmed, now requires root privileges, and no longer supports the --config option. These changes help prevent accidental deletion of CA private key material before migration to database-backed storage is complete.

PE-puppetdb plaintext listener is now disabled by default

PE-puppetdb no longer listens on the plaintext HTTP port (8080) by default. PuppetDB continues to serve requests over its SSL port (8081).

If you have tools, scripts, or integrations that connect directly to PuppetDB over port 8080, you must explicitly configure puppet_enterprise::profile::puppetdb::listen_port to re-enable the plaintext listener after upgrading.

Feature availability updates

Google Cloud SQL support status: Limited Availability

Support for using Puppet Enterprise with Google Cloud SQL for PostgreSQL is currently available as a Limited Availability feature. Limited Availability features are supported for production use and are available to eligible customers. For more information, see Configure PE to use Google Cloud SQL.

Platform support

Agent platforms added

This release adds support for the Puppet agent on the following operating system platforms:

• AlmaLinux 10

• Rocky Linux 10

• Ubuntu 26.04 AMD

• Ubuntu 26.04 ARM

Primary server platforms added

This release adds support for the following primary server platform:

• Ubuntu 26.04

Deprecations and removals

Removed primary platforms

This release removes support for the following primary server platform:

• Amazon Linux 2

Resolved issues

EC private keys in SEC1 format no longer cause catalog compilation failures

In PE 2025.11.0-2025.11.3, 2023.8.10 (May 2026 rebuild) and later 2023.8.x releases, Puppet Server could fail to load elliptic curve (EC) private keys stored in SEC1 format (-----BEGIN EC PRIVATE KEY-----) during catalog compilation. This issue was caused by an incompatibility between the bundled versions of Bouncy Castle and jruby-openssl, which could result in a NoSuchMethodError and prevent agents from retrieving catalogs. This issue is resolved in PE 2025.12.0 and 2026.0. [PE-45412]

PuppetDB metrics collection no longer fails in distributed collection deployments

In previous versions of PE, PuppetDB metrics collection could silently fail when a PuppetDB node was configured to collect its own metrics using the distributed metrics collection pattern, preventing PuppetDB metrics from being collected in affected deployments. This issue is resolved in PE 2026.0 and PE 2025.12.0. [PE-45680]

pe_patch::patch_server now correctly processes yum_params

In previous versions of PE, the pe_patch::patch_server task could ignore repositories specified through the yum_params parameter when no updates were detected in the currently enabled repositories. This could prevent available package updates from being identified and installed. This issue is resolved in PE 2025.12.0. [PE-38945]

Failed patch jobs now retry after transient database errors

In PE-2025.10-2025.11.3, patch jobs could fail when the patching service encountered transient database errors during patch operations. These failures could cause a patch job to stop unexpectedly and report an "Unknown cause" error. PE now retries these transient failures and provides more detailed error information when a job fails. This issue is resolved in PE 2026.0 and 2025.12.0. [PE-44700]

Orchestrator tasks no longer return incorrect results

In previous versions of PE, after an orchestrator reboot, agents could return cached data instead of running the requested task. This could cause jobs to report inaccurate results. This issue is resolved in PE 2023.8.12, 2025.12.0, and 2026.0. [PE-46864]

Cron resources no longer fail on Ruby 3.2-based agents

In previous versions of PE, catalog application could fail when a Cron resource used integer values for schedule parameters, such as values returned by fqdn_rand(). This issue could affect parameters including minute, hour, weekday, month, and monthday, and could prevent successful catalog application on agents running Ruby 3.2 and later. This issue is resolved in PE 2025.12.0 and 2026.0. [PE-451120]

Windows patch failures are now reported correctly

In PE 2025.6.0-2025.11.3, Windows patch runs could be incorrectly reported as successful when one or more patches failed to install. In affected cases, administrators reviewing patch run results could see a successful patch run even though the target node was not fully patched. This issue is resolved in PE 2025.12.0. [PE-45780]

Patch tasks can now report RPM scriptlet warnings as failures

In previous versions of PE, the pe_patch::patch_server task could report a successful patch operation even when RPM scriptlet warnings were reported during package installation. PE now includes the fail_on_scriptlet_warning parameter, which allows RPM scriptlet warnings to be treated as task failures so that patch jobs are reported correctly in the PE console. This parameter applies to RHEL/RPM-based platforms only. This issue is resolved in PE 2025.12.0. [PE-43725]

PCP Broker now rejects agent reconnections when all controllers are disconnected

In PE 2025.7 and later, PCP Broker could repeatedly accept and immediately close agent reconnections when all controller connections were unavailable. This could result in excessive reconnection attempts and increased load on affected brokers until controller connectivity was restored. This issue is resolved in PE 2025.12.0 and 2026.0. [PE-44683]

Puppet runs no longer fail after completing CA database-backed storage migration

In PE 2025.11-2025.11.3, Puppet runs on the primary server could fail after completing the final cutover step of the Certificate Authority (CA) migration to database-backed storage. This issue is resolved in PE 2026.0 and PE 2025.12.0. [PE-46832]

PE configuration recovery now restores the primary node's configuration consistently

In installations with multiple core infrastructure nodes, puppet infra recover_configuration could apply configuration values from a different core infrastructure node instead of the primary node. This could cause the primary node to lose its own identity and, in some cases, prevent PostgreSQL major-version upgrades. If console_host was configured with a hostname that did not match any node's certname, PE node group management could also stop running without warning. This issue is resolved in PE 2025.12.0 and 2026.0. [PE-46960]

Edge entitlement no longer increases Puppet Server load during agent runs

In previous versions of PE, agents in environments with the Edge entitlement enabled could download files that were not required for normal catalog runs. In large deployments, this behavior could increase Puppet Server load and contribute to out-of-memory conditions. This issue is resolved in PE 2026.0 and 2025.12.0. [PE-46835]

File resources in recursive directory sources now deploy successfully

In PE 2025.11, a fix for deployments involving filenames containing spaces applied only to individually sourced files. File resources using recursive directory sources (recurse => true) could still fail when filenames contained spaces or other special characters. This issue is resolved in PE 2025.12.0 and 2026.0.0, completing the fix introduced in PE 2025.11. [PE-46018]

Security fixes

The following CVEs were fixed in PE:

• CVE-2026-9828

• CVE-2026-10532

• CVE-2026-13006

• CVE-2026-35611

• CVE-2026-5917

• CVE-2026-53583

• CVE-2026-53584

• CVE-2026-53585

• CVE-2026-53586

• CVE-2026-53587

• CVE-2026-10050

• CVE-2026-10051

• CVE-2026-32280

• CVE-2026-32281

• CVE-2026-32283

• CVE-2026-32288

• CVE-2026-32289

• CVE-2026-27140

• CVE-2026-27143

• CVE-2026-27144

• CVE-2026-33810

• CVE-2026-42501

• CVE-2026-33811

• CVE-2026-33814

• CVE-2026-39817

• CVE-2026-39819

• CVE-2026-39820

• CVE-2026-39823

• CVE-2026-39825

• CVE-2026-39826

• CVE-2026-39836

• CVE-2026-42499

• CVE-2026-42504

• CVE-2026-42507

• CVE-2026-27145

• CVE-2026-39822

• CVE-2026-42505

• CVE-2026-56865

• CVE-2026-56864

• CVE-2026-56862

• CVE-2026-56859

• CVE-2026-56858

• CVE-2026-56860

• CVE-2026-56853

• CVE-2026-46600

• CVE-2026-39821

• CVE-2026-33818

• CVE-2026-33176

• CVE-2026-64607

• CVE-2026-71290