HashiCorp

Recently shipped Terraform 1.16 beta 2, Vault 2.0.4 security patches, and new HCP governance controls.

HCP added enterprise constraints and tightened SSO lifecycle. Organization admins can now restrict which products — Vault, Boundary, Packer, Waypoint, Vagrant, and more — users may deploy. Deleting an SSO connection now removes all SSO users from the org; suspending a connection leaves them intact.

Terraform 1.16 hit its second beta with on_failure modes and store blocks. Resources using create_before_destroy can specify halt, taint, or continue on failure, and terraform_data gained a store block for ephemeral and sensitive values. Providers now support nested blocks as computed values, import blocks work inside modules, and Linux s390x builds are available. The 1.17 alpha track carries the deferred-actions experiment and the test cleanup command; the 1.15 line saw 1.15.8, fixing a terraform init error with service-discovery provider aliases.

Vault 2.0.4 patched an ACL bypass and a SCIM boundary escape. A mixed-case policy name could slip past denied_parameters constraints; policy parameters are now normalized to lowercase before evaluation. The entity merge endpoint rejects SCIM-managed entities, and batch-delete no longer touches storage outside the caller's namespace. Breaking: UBI container images dropped the gnupg, openssl, and procps packages.

Nomad 2.0.4 and enterprise releases closed three security holes. CVE-2026-14891 and CVE-2026-14896 fixed Docker container escape paths via host namespace modes and symlink-based plugin bypasses; a namespace-crossing bug in dynamic host volume deletion was also fixed.

Consul 2.0.2 hardened Envoy inbound listeners and upgraded its Alpine base. Envoy listeners now return errors when injection of the L4 intention filter or mTLS socket fails, and Alpine moved to 3.24 for CVE fixes.