---
name: Vault
slug: vault
organization_slug: hashicorp
category: security
source_count: 1
canonical: https://releases.sh/hashicorp/vault
---

# Vault

## Sources (1)

- [Vault](https://releases.sh/hashicorp/vault-releases) — `github`

## Recent Releases

_Summaries below — fetch the release's `canonical` URL for full content, or `url` for the original source._

<Release source="vault-releases" version="v2.1.2" date="October 7, 2026" published="2026-10-07T13:31:18.000Z" url="https://github.com/hashicorp/vault/releases/tag/v2.1.2" canonical="https://releases.sh/release/rel_odFFBuQta3xGX1V-D_gvc" truncated="true">
</Release>

<Release source="vault-releases" version="v2.1.1" date="September 16, 2026" published="2026-09-16T21:04:32.000Z" url="https://github.com/hashicorp/vault/releases/tag/v2.1.1" canonical="https://releases.sh/release/rel_Kv8orv_AdvBO_P7VwbMQk" truncated="true">
Updates github.com/apache/thrift to v0.24.0, golang.org/x/crypto to v0.56.0, and google.golang.org/grpc to v1.83.2 to fix ghsa-8wv5-x4w7-5gww, GO-2026-6354, GO-2026-6355, and GHSA-2v4p-qf9q-27wj. Also fixes auth/token/lookup returning 403 for JWT tokens in non-root namespaces, a panic in `vault recover` without a path, and OIDC identity token billing units computed incorrectly across periodic flush cycles.
</Release>

<Release source="vault-releases" version="v2.1.0" date="September 1, 2026" published="2026-09-01T14:37:47.000Z" url="https://github.com/hashicorp/vault/releases/tag/v2.1.0" canonical="https://releases.sh/release/rel_9HDF-v31CXbquGfMC8wwY" truncated="true">
Adds automatic DNS-01 challenge fulfillment for PKI external CA via AWS Route53, Azure DNS, Google Cloud DNS, and RFC2136-compliant servers, plus PKCS#12/JKS bundle support and Agent Registry UI (enterprise). SLH-DSA now joins ECDSA/Ed25519 for hybrid sign/verify in the Transit engine. Two critical security patches, a denied-issuer-id mutation guard, and several data-loss-tier fixes including a Nomad connection-pool fix and SQL-injection sanitization in database username templates.
</Release>

<Release source="vault-releases" version="v2.0.4" date="August 4, 2026" published="2026-08-04T18:34:44.000Z" url="https://github.com/hashicorp/vault/releases/tag/v2.0.4" canonical="https://releases.sh/release/rel_sH-XRuZk3LrbPkR5FWmU7" truncated="true">
Fixed a privilege-escalation vulnerability where a denied_parameters constraint on the policies field could be bypassed with mixed-case policy names; Vault now normalizes to lowercase. Also removed gnupg, openssl, and procps from UBI container images, and dropped support for duplicate HCL attributes. Plus many enterprise and OSS bug fixes across billing, audit, identity, and SCIM.
</Release>

<Release source="vault-releases" version="v2.0.3" date="June 17, 2026" published="2026-06-17T20:23:38.000Z" url="https://github.com/hashicorp/vault/releases/tag/v2.0.3" canonical="https://releases.sh/release/rel_Kxk8EOqmbTPuQLpbNI5ws" truncated="true">
LIST requests with a trailing slash now correctly respect more-specific deny policies, fixing an ACL bypass where a request to `LIST kv/private/` could skip a `deny` on `kv/*`. Also introduces beta support for AI agents in Enterprise, including an agent registry and OAuth resource server capabilities. Plus a constant-time recovery token comparison and several security fixes across RADIUS, SPIFFE, and transform.
</Release>

<Release source="vault-releases" version="v2.0.2" date="June 5, 2026" published="2026-06-05T16:26:07.000Z" url="https://github.com/hashicorp/vault/releases/tag/v2.0.2" canonical="https://releases.sh/release/rel_ZXv3marU_AHe1heVKtvFj" truncated="true">
Vault containers no longer have the cap_ipc_lock capability, preventing calls to mlock() for memory locking—operators should set disable_mlock = true in configuration and disable swapping at runtime. SSH RSA key sizes are now limited to a maximum of 8192 bits (CVE-2026-39829). Also fixed plugin signature verification failures with expired PGP keys and a transit key version dropdown state issue.
</Release>

<Release source="vault-releases" version="v2.0.1" date="May 19, 2026" published="2026-05-19T20:57:55.000Z" url="https://github.com/hashicorp/vault/releases/tag/v2.0.1" canonical="https://releases.sh/release/rel_ECebbkEauMbVTBSKf5tRA" truncated="true">
</Release>

<Release source="vault-releases" version="v2.0.0" date="April 14, 2026" published="2026-04-14T20:07:04.000Z" url="https://github.com/hashicorp/vault/releases/tag/v2.0.0" canonical="https://releases.sh/release/rel_evuMgtlGgLnofoaSR-bgt" truncated="true">
</Release>

<Release source="vault-releases" version="v1.21.4" date="March 5, 2026" published="2026-03-05T06:37:01.000Z" url="https://github.com/hashicorp/vault/releases/tag/v1.21.4" canonical="https://releases.sh/release/rel_zG-KJfCEzhEHyeWa-rPPd" truncated="true">

SECURITY:

* Upgrade `cloudflare/circl` to v1.6.3 to resolve CVE-2026-1229
* Upgrade `filippo.io/edwards25519` to v1.1.1 to resolve GO-2026-4503
...
</Release>

<Release source="vault-releases" version="v1.21.3" date="March 4, 2026" published="2026-03-04T22:47:38.000Z" url="https://github.com/hashicorp/vault/releases/tag/v1.21.3" canonical="https://releases.sh/release/rel_W82rQVryTrA1i6w-H5E39" truncated="true">
## February 05, 2026
**SECURITY:**

auth/cert: ensure that the certificate being renewed matches the certificate attached to the session.

**CHAN...
</Release>

**Tags:** `encryption`, `secrets`