Last 7 days
0
Features: 0
Changes: 0
Fixes: 0
Deprecations: 0
HashiCorp Vault
Secrets management and data protection platform for infrastructure.
Latest HashiCorp Vault changelog updates, official release notes, breaking changes, security patches, pricing changes, and developer reactions in one product feed.
Follow this HashiCorp Vault release-notes page to spot useful features, risky migrations, noisy announcements, and source links before they hit your backlog.
Where HashiCorp Vault updates are checked
Changes.Watch links back to official changelog and release-note sources so summaries stay easy to verify.
Related changelog channels
Use channels to follow groups of tools around a stack, workflow, or topic.
HashiCorp Vault updates by type
Rolling windows show how many product updates landed in the last 7, 30, 90, and 365 days, grouped by existing changelog semantics.
0
1
3
9
Latest HashiCorp Vault changelog updates
BREAKING: UBI container images no longer include gnupg, openssl, or procps; duplicate HCL attributes now always cause errors and the legacy env var is removed
Added beta AI Agent Support with an Agent Registry and OAuth 2.0 JWT authorization for Vault requests.
Remove the container IPC capability causing Vault to lose mlock() support; operators must set disable_mlock=true and disable swapping for safety.
- BREAKING: containers now require IPC LOCK capability when running the vault container.
BREAKING CHANGE: docker helpers moved from github.com/docker/docker to github.com/moby/moby.
Security updates: upgraded cloudflare/circl, filippo.io/edwards25519, and OpenTelemetry SDK to address CVE‑2026‑1229 and related Go vulnerabilities.
Added security check to ensure renewed certificates match the session’s attached certificate.
Bumped core dependencies (Go 1.25.5, golang/x/crypto fixing CVEs) and updated plugins (OCI, Azure, Aerospike client).
Fixed a critical auth/aws caching issue and updated dependencies to address CVE‑2025‑63811, strengthening Vault security
Fix LDAP MFA/TOTP enforcement bypass when username‑as‑alias is enabled (security).
Security: added nonce requirement for cancelling recent rekey operations and API client now respects Retry-After header.
Update Snowflake database plugin to v0.13.1
Updated vault plugins (auth cf to v0.20.1, auth/azure to v0.20.4) and bumped Go to 1.24.3.
Updated auth/jwt plugin to v0.23.2.
Core upgraded to Go 1.23.8 and OpenLDAP plugin updated to v0.15.4.
Updated auth and secrets plugins for Azure, GCP, OpenLDAP, AWS, and added mount type to activity counters API response.
Introduced multiple security and automation capabilities, including RSA key size enforcement, automated root rotation for AWS, DB, and GCP plugins, identity deduplication, a new Rotation Manager, and audit logging of User‑Agent headers.
Updated auth/cf plugin to v0.19.1 and aligned Go SDK and dependency versions across core, API, and SDK for consistency and security fixes.
Updated plugins and SDKs (openldap to v0.14.4, PKI issuer‑constraint enforcement, Okta SDK upgraded to v5 with go‑jose 3.0.3) and added new post‑unseal trace configuration options.
Added Product Usage Reporting and UI navigation for LDAP hierarchical roles (new features).
Updated Azure auth, Azure secrets, and OpenLDAP secret plugins to newer versions.
Added GA Adaptive Overload Protection for write requests, Audit Entry Exclusion rules, AWS STS session tags, KV v2 subkey patch GUI, Self‑Managed Static Roles, Minimal Vault build option, and PKI 3GPP CMPv2 server support.
Bumped Go runtime to 1.22.7 and upgraded the OpenLDAP secret plugin to v0.13.1.
Fixed audit log regression exposing client tokens and token accessors in plaintext.
Improved activity client‑count handling: filtered fields, consistent sorting, and warnings for estimated counts in the API and CLI.
Updated auth/cf plugin to v0.18.0 and added auth/cert role‑trust caching plus auto‑roll of billing start dates for enterprise license utilization.
Added support for STS session tags in the AWS secrets engine
Updated auth/jwt plugin to v0.21.0 and added UI support for creating session‑token‑type roles for the AWS secrets engine.
Breaking changes: audit logs can now include 'correlation-id' headers (not HMAC'ed by default) and HA seal requires 'multiseal' enabled; the Request Limiter beta is deprecated.
Updated auth/jwt plugin to v0.17.3 and bumped Go to 1.22.2.
Updated auth/jwt plugin to v0.16.1 and bumped Go runtime to 1.22.2.
Upgrade auth/jwt plugin to v0.20.3, bump Go version to 1.22.2, and add missing delegated‑auth field to the /sys/mounts API response.
Updated core Go version to 1.21.9, refreshed UI dependencies (including D3), and made encryption timeout configurable via env var, plus added retention months to license utilization reports.
Extended activity log retention to 48 months and added retention months to license utilization reports.
Fix LDAP auth login errors (group search anonymous bind and missing entity alias)
Fixed security issues in cert auth: OCSP response issuer/serial validation and fail‑open handling for unreachable OCSP servers.
Fixed several auth/cert OCSP handling issues, including proper issuer validation, caching, and allowing login when OCSP servers are unreachable
Security fixes for cert authentication (public‑key comparison, OCSP validation) and a transit nonce regression fix.
Added security check comparing public keys of trusted non‑CA certificates to prevent key‑serial mismatch attacks
Fixed security issue by verifying public keys of trusted non‑CA certificates to prevent spoofed certs with matching serial numbers.
Fix security issue where 'log raw' option could cause other devices to log raw audit data.
Upgrade core Go to 1.20.12, update Snowflake plugin to v0.9.2, and bump Raft storage to bbolt 1.3.8 with performance patch.
Bumped Go to 1.20.12, upgraded Snowflake plugin to v0.7.4 and bbolt to 1.3.8 with a performance patch for raft storage scanning.
Patch critical CVE-2023-6337 to stop denial-of-service via memory exhaustion on large HTTP requests.
Fix critical DoS vulnerability (CVE‑2023‑6337) in core handling of large HTTP requests.
Fix critical DoS vulnerability (CVE-2023-6337) where large HTTP requests could exhaust host memory.
Updated Go runtime to 1.21.4, added seal type reporting in sys/seal status, and accelerated unseal operations with namespaces.
Updated core to Go 1.20.11, sped up namespace unseal, and improved UI sorting and package updates.
Upgrade Go runtime to 1.20.11 and speed up unseal operations when using namespaces.
Fixed CVE‑2023‑5954 memory consumption DoS vulnerability in core request handling (security).
Fixed CVE‑2023‑5954 memory consumption DoS vulnerability in core inbound request handling.
Fixed a critical memory‑consumption DoS vulnerability (CVE‑2023‑5954) in core request handling.
Bumped Go version to 1.21.3 and added a TLS server‑name argument for plugin registration.
Added TLS server name argument for plugin registration, introduced a worker‑pool with metrics for the rollback manager, and added a KV download toggle plus UI navigation fixes.
Bumped Go to 1.20.10 and updated replication to use a non‑deprecated gRPC field.
Fix: Secrets/Transit encryption regression with non‑convergent nonces (security fix).
Added pagination to PKI and SSH UI list pages and introduced an allowed domains field for SSH CA roles.
Added allowed‑domains template field to CA role in SSH engine UI.
Added Merkle Tree Corruption Detection endpoint (enterprise) and upgraded Go runtime to 1.20.8.
Added enterprise Merkle Tree corruption detection endpoint and improved LDAP login concurrency and quota calculation options.
Fixed a security regression in secrets/transit where nonces were incorrectly honored in non‑convergent encryption modes.
Updated plugins (auth/azure to v0.16.0, database/snowflake to v0.9.0) and bumped Go to 1.20.7; added Azure Workload Identity Federation support for auto auth.
Bumped Go to 1.20.7 and added logging for rollback manager failures to prevent replication issues on secondary clusters.
Updated Go to 1.19.12 and added logging for rollback manager failures to avoid replication issues on secondary clusters.
Introduced high‑privilege (administrative) namespaces and added FIPS 140‑2 RPM/DEB packages, plus new enterprise metrics and max‑TTL enforcement for transform roles.
Added high‑privilege (administrative) namespaces and new metrics for policy count and enterprise secret plugin status.
Enforced max TTL on transform role encodes, switched transform secrets to pgx driver, and added FIPS 140‑2 RPM/DEB packages.
Breaking: PKI secrets engine stops maintaining stored certificate counts by default and the SSCT feature toggle is removed.
Breaking: certificate count metrics are disabled by default; can be re‑enabled via tidy config settings.
Breaking: secrets/pki stored certificate count metrics disabled by default; re‑enable via config flags.
Bump Go runtime to 1.19.10 and add several raft metrics and improvements for OSS standbys
Added new replication API parameter to set primary cluster addresses directly and introduced key import commands for Transform and Transit secret engines.
Added ability to dump pprof profiling data to disk via SIGUSR2 when VAULT_PPROF_WRITE_TO_FILE=true, and enriched audit logs with mount point and namespace path fields.
Added support for dumping pprof files to the filesystem via SIGUSR2 when the VAULT_PPROF_WRITE_TO_FILE flag is set.
Bumped Go version to 1.20.3 and re‑added debug symbols to support Dynatrace.
Upgrade core to Go 1.19.8 and introduce multiple new features: detailed namespace flag, test activity log endpoint, raft entry size field in config, LDAP connection timeout option, and reduced OCSP response size.
Core updates: bump Go to 1.19.8; add raft sub‑field with max entry size to /sys/config/state/sanitized and a test activity‑log endpoint behind a build flag.
Added optional GitHub auth token environment variable for authenticated org ID fetches and documented it (VAULT_AUTH_CONFIG_GITHUB_TOKEN).
Added optional GitHub auth token environment variable and docs for configuring it.
Add optional GitHub auth token and gRPC connect timeout environment variables, with documentation for the GitHub token.
Bumped the core Go runtime to version 1.19.6.
Upgraded the core Go runtime to version 1.19.6.
Upgrade Go runtime to 1.19.6 across core components.
- Security: removed deprecated dynamic‑keys mode (now errors on expired leases) and added configurable user‑lockout for LDAP, userpass and approle to mitigate brute‑force attacks.
Upgrade core Go version to 1.19.4 and re‑enable upstream FIPS 140‑2 toolchain for compliance.
Updated Go runtime to 1.19.4 and restored upstream toolchain for FIPS 140‑2 compliance
Bumped Go runtime to 1.19.4 and restored upstream toolchain for FIPS‑140‑2 compliance.
Mounts pinned to a specific builtin version now auto‑upgrade and can be overridden, and builtin plugin deprecation reporting is limited to builtins.
Enabled PKI issuer creation and default issuer updates via "default follows latest issuer".
Fixed concurrency and deadlock issues in core components, including lock contention in enterprise quotas and a startup race condition causing mount loops.
Added new capabilities: VAULT_DISABLE_REDIRECTS env var and flag to stop redirect following, parallel Snowflake request support, plugin version info in lifecycle logs, and LDAP group paging support.
Add parallel request support for Snowflake and LDAP group filter paging
Improved error handling for enterprise managed key creation and fixed panic when cache is disabled
Added new features such as GCP Cloud KMS managed keys, LDAP secrets engine, OCSP responder for PKI, Redis DB and ElastiCache plugins, Transform BYOK, HCP self‑managed node support, UI Okta challenge, and secret/auth plugin multiplexing.
Added non‑disruptive PKI intermediate/root certificate rotation and expanded API capabilities (PEM‑byte certs, context‑aware functions, MFALogin, WithNamespace, global output‑policy flag).
Removed etcd v2 support and switched default lease TTL values from nanoseconds to seconds in the /sys/config/state/sanitized endpoint, making those API responses breaking changes.
Added dynamic reloading of short‑lived Kubernetes tokens and support for go sockaddr templates in cluster address configuration.
Fixed OIDC authentication flow in the Vault UI and addressed code scanning alerts.
Fix code scanning alerts in core component
Update Go runtime to version 1.17.5.
Upgrade Go runtime to version 1.16.12
Update Go runtime to 1.16.12
Upgrade Aerospike Go client to v5.6.0 and prevent performance standby nodes from serving stale data after election.
Updated Go runtime to version 1.16.9.
Fixed HA standby nodes from serving stale data after performance standby election.
Added many new features: customizable HTTP headers, KV v2 custom metadata and PATCH support, OIDC provider (tech preview), namespace API locking, GCP KMS key management, local auth mount entities, and UI enhancements for Elasticsearch, O...
Fixed AWS auth config rotation to store new key and cleaned up in‑memory entity aliases after deletion, preventing creation of conflicting aliases.
Fixed multiple authentication, identity, and HA deadlock issues, including AWS root key rotation and HA leadership transfer deadlock.
Updated Oracle Cloud library to enable seal integration with UK Gov London 1 region.
Added PKI support for signing self‑issued certificates with a different signature algorithm and enforced a minimum cache size for the Transit backend, initializing it without restart.
Secrets/pki now supports signing self‑issued certificates using a different signature algorithm.
Fixed password policy generation bug on namespaces when invoked outside request callbacks or external plugins.
Updated Go runtime to version 1.16.7.
Patched security vulnerability (CVE‑2021‑38554) where the UI cached and exposed secrets across sessions, with automatic page refresh on logout.
Fix for UI secret caching vulnerability (CVE‑2021‑38554) that exposed secrets across sessions
Added support for external source “vault” metadata in Consul service registration.
Added new secrets engine capabilities: GCP static accounts, AWS KMS key management GA, MySQL DB UI enhancements, and a Vault Diagnose operator command.
Release of vault version v1.7.3.
Fix for CVE‑2021‑32923: prevents non‑expiring token and dynamic secret leases by correcting zero‑TTL handling.
Fix CVE-2021-32923 where zero‑TTL token and secret leases became non‑expiring, affecting Vault 0.10.0‑1.7.1.
Fixed CVE‑2021‑32923: corrected lease renewal logic to prevent token and dynamic secret leases with zero‑second TTL from becoming non‑expiring (security fix).
New version v1.5.8 of the vault released
Release of Vault version 1.6.4.
Added Aerospike storage backend and expanded secret engine support (dynamic usernames for many databases, Terraform Cloud token engine, IAM tagging for AWS, OpenLDAP dynamic roles, UI wizard for DB secrets)
Fix for CVE‑2021‑27668: prevents unauthenticated reading of Vault licenses on DR secondary clusters.
Fixed multiple security vulnerabilities (IP address disclosure, unauthenticated remove‑peer, mount‑path disclosure) addressing CVE‑2021‑3024, CVE‑2021‑3282, and CVE‑2020‑25594.
Fixed two security vulnerabilities: IP address disclosure (CVE‑2021‑3024) and mount‑path disclosure (CVE‑2020‑25594) affecting Vault and Vault Enterprise.
Vault version 1.6.1 released
Version v1.5.6 has been released.
- Released Vault version v1.6.0