PE 2026.0

Released October 2026

Puppet Enterprise (PE) 2026.0 introduces support for Puppet 9, expands platform support, and delivers enhancements to Certificate Authority (CA) management, security, and platform reliability. This release also includes fixes for multiple security vulnerabilities.

Puppet Enterprise^® lifecycle update

Starting in August 2026, Puppet Enterprise transitioned its software support model from Long-Term Support (LTS) and Short-Term Support (STS) to the Latest and Latest-1 model. This change applies to both PE and PE Advanced. To learn more, see Puppet Enterprise Platform Support Lifecycle.

Enhancements

Puppet Enterprise 2026.0 now supports Puppet 9

Before upgrading to Puppet 9, review the Puppet 9 upgrade considerations and verify compatibility with your PE version.

For more information, see:

• Puppet 9 upgrade considerations

• Server and agent compatibility

• Supported operating systems

Database-backed Certificate Authority storage is now the default for new installations

New Puppet Enterprise installations now use database-backed Certificate Authority (CA) storage by default. CA data is stored in the pe-ca PostgreSQL database instead of the local file system. Existing installations upgraded from earlier releases retain their current CA storage backend configuration.

PE now recommends database-backed CA storage during upgrade

PE now displays a recommendation during upgrade for administrators who have not explicitly selected a Certificate Authority (CA) storage backend. The recommendation includes guidance on migrating to the database-backed CA storage backend. Existing installations continue to use their current CA storage backend unless an administrator chooses to migrate.

Certificate Authority now limits pending certificate signing requests

Puppet Enterprise now limits the number of pending certificate signing requests (CSRs) that Puppet Server accepts, helping protect Certificate Authority (CA) infrastructure from disk-fill denial-of-service attacks caused by unauthenticated CSR flooding. By default, Puppet Server accepts up to 50,000 pending CSRs. When the limit is reached, requests for new certificate subjects receive an HTTP 503 response until existing pending CSRs are signed or removed.

CA storage migration: Added safety checks for --cleanup-fs

The puppetserver ca storage --cleanup-fs command now verifies that the active CA storage backend is database before archiving and deleting the CA directory. The command exits with an error if the backend cannot be confirmed, now requires root privileges, and no longer supports the --config option. These changes help prevent accidental deletion of CA private key material before migration to database-backed storage is complete.

PE-puppetdb plaintext listener is now disabled by default

PE-puppetdb no longer listens on the plaintext HTTP port (8080) by default. PuppetDB continues to serve requests over its SSL port (8081).

If you have tools, scripts, or integrations that connect directly to PuppetDB over port 8080, you must explicitly configure puppet_enterprise::profile::puppetdb::listen_port to re-enable the plaintext listener after upgrading.

Feature availability updates

Google Cloud SQL support status: Limited Availability

Support for using Puppet Enterprise with Google Cloud SQL for PostgreSQL is currently available as a Limited Availability feature. Limited Availability features are supported for production use and are available to eligible customers. For more information, see Configure PE to use Google Cloud SQL.

Platform support

Agent platforms added

This release adds support for the Puppet agent on the following operating system platforms:

• AlmaLinux 10

• Rocky Linux 10

• Ubuntu 26.04 AMD

• Ubuntu 26.04 ARM

Primary server platforms added

This release adds support for the following primary server platform:

• Ubuntu 26.04

Deprecations and removals

Removed agent platforms

This release removes support for the following agent platforms:

• Amazon Linux 2 aarch64

• Debian 10 amd64

• Red Hat Enterprise Linux 7 x86_64

• Red Hat Enterprise Linux 7 FIPS x86_64

• Fedora 36 x86_64

• Fedora 40 x86_64

• Microsoft Windows 10 x64

• Microsoft Windows 10x86

• Ubuntu 18.04 amd64

• Ubuntu 18.04 aarch64

• Ubuntu 20.04 amd64

• Ubuntu 20.04 aarch64

Removed primary server platform

This release removes support for the following primary server platforms:

• Ubuntu 20.04 amd64

Resolved issues

EC private keys in SEC1 format no longer cause catalog compilation failures

In PE 2025.11.0-2025.11.3, 2023.8.10 (May 2026 rebuild) and later 2023.8.x releases, Puppet Server could fail to load elliptic curve (EC) private keys stored in SEC1 format (-----BEGIN EC PRIVATE KEY-----) during catalog compilation. This issue was caused by an incompatibility between the bundled versions of Bouncy Castle and jruby-openssl, which could result in a NoSuchMethodError and prevent agents from retrieving catalogs. This issue is resolved in PE 2025.12.0 and 2026.0. [PE-45412]

PuppetDB metrics collection no longer fails in distributed collection deployments

In previous versions of PE, PuppetDB metrics collection could silently fail when a PuppetDB node was configured to collect its own metrics using the distributed metrics collection pattern, preventing PuppetDB metrics from being collected in affected deployments. This issue is resolved in PE 2026.0 and PE 2025.12.0. [PE-45680]

Failed patch jobs now retry after transient database errors

In PE-2025.10-2025.11.3, patch jobs could fail when the patching service encountered transient database errors during patch operations. These failures could cause a patch job to stop unexpectedly and report an "Unknown cause" error. PE now retries these transient failures and provides more detailed error information when a job fails. This issue is resolved in PE 2026.0 and 2025.12.0. [PE-44700]

Orchestrator tasks no longer return incorrect results

In previous versions of PE, after an orchestrator reboot, agents could return cached data instead of running the requested task. This could cause jobs to report inaccurate results. This issue is resolved in PE 2023.8.12, 2025.12.0, and 2026.0. [PE-46864]

Cron resources no longer fail on Ruby 3.2-based agents

In previous versions of PE, catalog application could fail when a Cron resource used integer values for schedule parameters, such as values returned by fqdn_rand(). This issue could affect parameters including minute, hour, weekday, month, and monthday, and could prevent successful catalog application on agents running Ruby 3.2 and later. This issue is resolved in PE 2025.12.0 and 2026.0. [PE-451120]

PCP Broker now rejects agent reconnections when all controllers are disconnected

In PE 2025.7 and later, PCP Broker could repeatedly accept and immediately close agent reconnections when all controller connections were unavailable. This could result in excessive reconnection attempts and increased load on affected brokers until controller connectivity was restored. This issue is resolved in PE 2025.12.0 and 2026.0. [PE-44683]

Puppet runs no longer fail after completing CA database-backed storage migration

In PE 2025.11-2025.11.3, Puppet runs on the primary server could fail after completing the final cutover step of the Certificate Authority (CA) migration to database-backed storage. This issue is resolved in PE 2026.0 and PE 2025.12.0. [PE-46832]

PE configuration recovery now restores the primary node's configuration consistently

In installations with multiple core infrastructure nodes, puppet infra recover_configuration could apply configuration values from a different core infrastructure node instead of the primary node. This could cause the primary node to lose its own identity and, in some cases, prevent PostgreSQL major-version upgrades. If console_host was configured with a hostname that did not match any node's certname, PE node group management could also stop running without warning. This issue is resolved in PE 2025.12.0 and 2026.0. [PE-46960]

Edge entitlement no longer increases Puppet Server load during agent runs

In previous versions of PE, agents in environments with the Edge entitlement enabled could download files that were not required for normal catalog runs. In large deployments, this behavior could increase Puppet Server load and contribute to out-of-memory conditions. This issue is resolved in PE 2026.0 and 2025.12.0. [PE-46835]

File resources in recursive directory sources now deploy successfully

In PE 2025.11, a fix for deployments involving filenames containing spaces applied only to individually sourced files. File resources using recursive directory sources (recurse => true) could still fail when filenames contained spaces or other special characters. This issue is resolved in PE 2025.12.0 and 2026.0.0, completing the fix introduced in PE 2025.11. [PE-46018]

Security fixes

The following CVEs were fixed in PE:

• CVE-2026-9828

• CVE-2026-10532

• CVE-2026-13006

• CVE-2026-35611

• CVE-2026-5917

• CVE-2026-53583

• CVE-2026-53584

• CVE-2026-53585

• CVE-2026-53586

• CVE-2026-53587

• CVE-2026-10050

• CVE-2026-10051

• CVE-2026-32280

• CVE-2026-32281

• CVE-2026-32283

• CVE-2026-32288

• CVE-2026-32289

• CVE-2026-27140

• CVE-2026-27143

• CVE-2026-27144

• CVE-2026-33810

• CVE-2026-42501

• CVE-2026-33811

• CVE-2026-33814

• CVE-2026-39817

• CVE-2026-39819

• CVE-2026-39820

• CVE-2026-39823

• CVE-2026-39825

• CVE-2026-39826

• CVE-2026-39836

• CVE-2026-42499

• CVE-2026-42504

• CVE-2026-42507

• CVE-2026-27145

• CVE-2026-39822

• CVE-2026-42505

• CVE-2026-56865

• CVE-2026-56864

• CVE-2026-56862

• CVE-2026-56859

• CVE-2026-56858

• CVE-2026-56860

• CVE-2026-56853

• CVE-2026-46600

• CVE-2026-39821

• CVE-2026-33818

• CVE-2026-33176

• CVE-2026-64607

• CVE-2026-71290

• CVE-2026-68494

• CVE-2026-54512