PE 2025.12.1

Released November 2026

Puppet Enterprise (PE) 2025.12.1 delivers security, platform support, and reliability improvements, including stricter authorization rule matching, support for Oracle Linux 10 x86_64 agents, and enhancements to cloud database deployments, backup and recovery operations, orchestration workflows, and File Sync. This release also includes fixes for multiple security vulnerabilities.

Puppet Enterprise^® lifecycle update

Starting in August 2026, Puppet Enterprise transitioned its software support model from Long-Term Support (LTS) and Short-Term Support (STS) to the Latest and Latest-1 model. This change applies to both PE and PE Advanced. To learn more, see Puppet Enterprise Platform Support Lifecycle.

Enhancements

Authorization rules now use stricter certificate name matching

Authorization rules in auth.conf now match certificate names more strictly. Rules that specify a hostname match only certificates with that exact name. Wildcard rules such as *.example.com now match only names under example.com and no longer match example.com itself. If you rely on a wildcard rule to allow the bare domain, add a separate rule for that domain name.

Platform support

Agent platforms added

This release adds support for the Puppet agent on the following operating system platforms:

• Oracle Linux 10 x86_64

Resolved issues

Cloud database installs no longer grant CONNECT access to PUBLIC

In PE 2025.12.0 and 2026.0, cloud database deployments could leave CONNECT privileges granted to PUBLIC on most PE databases. This allowed other roles on the same database instance to establish connections to those databases. PE now revokes CONNECT access from PUBLIC for cloud database deployments, aligning cloud database behavior with local installations. This issue is resolved in PE 2025.12.1 and 2026.0.1. [PE-47115]

Database connection permissions now converge correctly on migrated Cloud SQL deployments

In PE 2025.12.0 and 2026.0, Puppet runs on deployments migrated from local PostgreSQL to Google Cloud SQL could repeatedly report changes because database connection permissions were not applied correctly for some PE databases. As a result, the deployment might never reach a converged state. This issue is resolved in PE 2025.12.1 and 2026.0.1. [PE-47136]

pe-bolt-server now validates upload file paths

In previous releases, the pe-bolt-server upload file handler did not sufficiently validate file paths supplied in upload requests. PE now validates upload paths to ensure uploaded files remain within the intended job cache directory. This issue is resolved in PE 2025.12.1 and 2026.0.1. [PE-47314]

Daily log rotation no longer interrupts running plans

In previous PE versions, daily log rotation could restart the pe-plan-runner service while a plan was running. This caused orchestrated plans to abort before completion and could affect infrastructure workflows such as replica upgrades. This issue is resolved in PE 2026.0.1, 2025.12.1 and 2023.8.13 [PE-47319]

Certificate-only restores no longer cause CA inconsistencies on database-backed deployments

In PE 2026.0 and 2025.12.0, using puppet-backup restore --scope=certs on a primary configured to use the database CA backend could leave the restored CA files out of sync with the CA data stored in the pe-ca database. As a result, SSL communication and configuration operations could fail. This issue is resolved in PE 2026.0.1 and 2025.12.1. [PE-47558]

File Sync commit requests no longer hang in live-dir-mode: all

In previous releases, File Sync commit requests in live-dir-mode: all could hang indefinitely if an error occurred during commit processing. File Sync now returns a failed response instead of hanging and logs the underlying cause. This issue is resolved in PE 2025.12.1. [PE-47041]

CD4PE jobs no longer fail with Puppet agent 9.1.1

In PE 2026.0.0, cd4pe_jobs module version 1.7.5 could fail when running jobs with Puppet agent 9.1.1 due to a missing dependency. As a result, repository and script payloads could fail to decompress, causing job execution to fail with an uninitialized constant GZipHelper::FileUtils error. This issue is resolved in PE 2026.0.1, 2025.12.1 and 2023.8.13. [PE-47501]

Updated trust stores remove revoked certificate authorities

PE now includes updated certificate trust stores that remove the compromised eMudhra intermediate CA certificates from the bundled trust chain. In addition, PE components that use the Go runtime have been updated to incorporate the latest certificate validation protections. These changes are included in PE 2026.0.1, 2025.12.1, and 2023.8.13. [PE-47591]

Backups now work with password-authenticated external PostgreSQL databases

In PE 2025.12.0 and 2026.0, puppet-backup create could fail on installations that use an external PostgreSQL server with password authentication (puppet_enterprise::database_cert_auth: false). Database passwords were no longer available through PuppetDB, causing backup operations that include databases to fail authentication. PE now retrieves database credentials from a secure local source, allowing backups to complete successfully on affected installations. This issue is resolved in PE 2026.0.1 and 2025.12.1. [PE-47131]

Security fixes

The following CVEs were fixed in PE:

• CVE-2026-17508

• CVE-2026-18036

• CVE-2026-18040

• CVE-2026-71888

• CVE-2026-71889

• CVE-2026-71891

• CVE-2026-71892

• CVE-2026-97873

• CVE-2026-115731

• CVE-2026-115732

• CVE-2026-97629

• CVE-2026-93479

• CVE-2026-97205

• CVE-2026-15176

• CVE-2026-95101