Vault

October 15, 2026

BREAKING CHANGES:

• containers: Remove cap_ipc_lock capability on vault at build time to allow running Vault in common container runtimes. Vault in containers will no longer be able to call mlock() to lock memory. Operators should set…

Updates github.com/apache/thrift to v0.24.0, golang.org/x/crypto to v0.56.0, and google.golang.org/grpc to v1.83.2 to fix ghsa-8wv5-x4w7-5gww, GO-2026-6354, GO-2026-6355, and GHSA-2v4p-qf9q-27wj. Also fixes auth/token/lookup returning 403 for JWT tokens in non-root namespaces, a panic in vault recover without a path, and OIDC identity token billing units computed incorrectly across periodic flush cycles.

Adds automatic DNS-01 challenge fulfillment for PKI external CA via AWS Route53, Azure DNS, Google Cloud DNS, and RFC2136-compliant servers, plus PKCS#12/JKS bundle support and Agent Registry UI (enterprise). SLH-DSA now joins ECDSA/Ed25519 for hybrid sign/verify in the Transit engine. Two critical security patches, a denied-issuer-id mutation guard, and several data-loss-tier fixes including a Nomad connection-pool fix and SQL-injection sanitization in database username templates.

Fixed a privilege-escalation vulnerability where a denied_parameters constraint on the policies field could be bypassed with mixed-case policy names; Vault now normalizes to lowercase. Also removed gnupg, openssl, and procps from UBI container images, and dropped support for duplicate HCL attributes. Plus many enterprise and OSS bug fixes across billing, audit, identity, and SCIM.

LIST requests with a trailing slash now correctly respect more-specific deny policies, fixing an ACL bypass where a request to LIST kv/private/ could skip a deny on kv/*. Also introduces beta support for AI agents in Enterprise, including an agent registry and OAuth resource server capabilities. Plus a constant-time recovery token comparison and several security fixes across RADIUS, SPIFFE, and transform.

Vault containers no longer have the cap_ipc_lock capability, preventing calls to mlock() for memory locking—operators should set disable_mlock = true in configuration and disable swapping at runtime. SSH RSA key sizes are now limited to a maximum of 8192 bits (CVE-2026-39829). Also fixed plugin signature verification failures with expired PGP keys and a transit key version dropdown state issue.

SECURITY:

• Upgrade cloudflare/circl to v1.6.3 to resolve CVE-2026-1229
• Upgrade filippo.io/edwards25519 to v1.1.1 to resolve GO-2026-4503
• vault/sdk: Upgrade cloudflare/circl to v1.6.3 to resolve CVE-2026-1229
• vault/sdk: Upgrade go.opentelemetry.io/otel/sdk to…

February 05, 2026

SECURITY:

auth/cert: ensure that the certificate being renewed matches the certificate attached to the session.

CHANGES:

core: Bump Go version to 1.25.6

FEATURES:

UI: Hashi-Built External Plugin Support: Recognize and support…

1.21.2

January 07, 2026

CHANGES:

• auth/oci: bump plugin to v0.20.1
• core: Bump Go version to 1.25.5
• packaging: Container images are now exported using a compressed OCI image layout.
• packaging: UBI container images are now built on the UBI 10 minimal…

1.21.1

November 20, 2025

SECURITY:

• auth/aws: fix an issue where a user may be able to bypass authentication to Vault due to incorrect caching of the AWS client
• ui: disable scarf analytics for ui builds

CHANGES:

• auth/kubernetes: Update plugin to…

August 06, 2025

SECURITY:

• auth/ldap: fix MFA/TOTP enforcement bypass when username_as_alias is enabled…