LIST requests with a trailing slash now correctly respect more-specific deny policies, fixing an ACL bypass where a request to LIST kv/private/ could skip a deny on kv/*. Also introduces beta support for AI agents in Enterprise, including an agent registry and OAuth resource server capabilities. Plus a constant-time recovery token comparison and several security fixes across RADIUS, SPIFFE, and transform.
Vault containers no longer have the cap_ipc_lock capability, preventing calls to mlock() for memory locking—operators should set disable_mlock = true in configuration and disable swapping at runtime. SSH RSA key sizes are now limited to a maximum of 8192 bits (CVE-2026-39829). Also fixed plugin signature verification failures with expired PGP keys and a transit key version dropdown state issue.
SECURITY:
cloudflare/circl to v1.6.3 to resolve CVE-2026-1229filippo.io/edwards25519 to v1.1.1 to resolve GO-2026-4503cloudflare/circl to v1.6.3 to resolve CVE-2026-1229go.opentelemetry.io/otel/sdk to…SECURITY:
auth/cert: ensure that the certificate being renewed matches the certificate attached to the session.
CHANGES:
core: Bump Go version to 1.25.6
FEATURES:
UI: Hashi-Built External Plugin Support: Recognize and support…
CHANGES:
SECURITY:
CHANGES:
SECURITY:
SECURITY:
CHANGES:
SECURITY:
CHANGES:
Enterprise LTS: Vault Enterprise 1.19 is a Long-Term Support (LTS) release.
CHANGES:
Upgraded Alpine base image to 3.24 to address CVE-2026-41989 and ALPINE-CVE-2026-2100, and upgraded Serf and Memberlist to their latest ver…
HashiCorp · ConsulFixed a security bug where users with host-volume-delete permission in one namespace could delete claims from another namespace. Also fixed…
HashiCorp · NomadCustom OAuth providers now support a per-provider custom_claims_allowlist for controlling which claims are included in tokens. Also include…
Supabase · AuthSync OpenAPI client is now lazily initialized, preventing startup overhead. Sandbox dataplane operations no longer depend on sandbox status…
LangChain · LangSmith