CHANGELOG.md
Rama main · réplica de lectura del repositorio original.
## Previous versions
- [v1.10.0 - v1.15.16](CHANGELOG-v1.10-v1.15.md)
- [v1.0.0 - v1.9.10](CHANGELOG-pre-v1.10.md)
- [v0.11.6 and earlier](CHANGELOG-v0.md)
## 2.2.1
### October 22, 2026
SECURITY:
* containers/alpine: Upgrade ca-certificates-bundle to 20261020-r0 to distrust eMudhra intermediate chains.
* containers/UBI: explicitly disallow emSign Root CA and Comodo AAA Services in the CA trust store to distrust eMudhra intermediate chains.
* core/policy: Fixed a cache-key collision vulnerability that could cause policy-name aliases to resolve to the immutable root policy. Root-policy aliases are now explicitly rejected at entity, group, token, authentication-response, and agent-registry policy assignment boundaries. Previously accepted root-equivalent policy aliases (e.g., "./root", "a/../root") are now rejected.
CHANGES:
* core: Bump Go version to 1.27.3 to resolve CVE-2026-111943.
IMPROVEMENTS:
* agent: Add auto auth SPIFFE method.
BUG FIXES:
* core/quotas (enterprise): Fixed a bug where role-based quotas would fail to determine roles where the role is stored as `form-data`.
* identity (enterprise): Fix updates to tpmgroup membership not taking effect on active node when the tpmgroup by-name endpoint is used for the update. Reads showed the change applied to storage, but the inmem index wasn't updated.
* identity/scim (enterprise): Fix `POST /Users` returning 409 instead of adopting an unmanaged entity whose name matches the `userName`, such as after `unlink-entity`. Adoption now depends only on the matching alias, and the name conflict check applies only when a new entity is created.
* managed-keys (enterprise): Fix wrapper error in using managed keys for MACs
* secrets/database/mssql: Safely quote database and user identifiers during default user revocation and parameterize principal lookups, so that logins whose names contain characters outside the database code page are removed rather than left disabled. Default password rotation now quotes the username and escapes the password.
storage/mssql, storage/mysql: Escape configured SQL identifiers when constructing storage queries.
* transit (enterprise): Fix key check to allow use of managed keys for HMAC
* transit (enterprise): Fix error with using CMAC keys after rotation from an HMAC key using the Rotate with Algorithm Change endpoint
* transit (enterprise): Fix error with using managed keys for datakey generation after rotation using the Rotate with Algorithm Change endpoint
* ui: Fix MFA form breadcrumbs rendering in enforcement section, updated radio cards to use HDS
## 2.2.0
### October 15, 2026
BREAKING CHANGES:
* containers: Remove `cap_ipc_lock` capability on `vault` at build time to allow running Vault in common container runtimes. Vault in containers will no longer be able to call `mlock()` to lock memory. Operators should set `disable_mlock = true` in Vault's configuration. Runtime operators are advised to disable swapping to guarantee data safety.
* containers: The following packages have been removed from UBI based container images: gnupg, openssl, procps.
* containers: set cap_ipc_lock capability on vault at build time. Container runtimes will need to add `IPC_LOCK` capabilities when running the vault container.
* physical/postgresql: breaking change - PostgreSQL storage backend authentication now prefers Azure Workload Identity over Managed Identity. Update `go-pgmultiauth` to v1.1.0. Existing Managed Identity-based PostgreSQL configurations may stop working if Workload Identity is configured. Affected users must migrate PostgreSQL authentication to Workload Identity.
* pki: ACME finalization with the default `sign-verbatim` directory policy now rejects CSRs that contain URI SANs, email SANs, or Other SANs. ACME challenges only verify DNS names and IP addresses; those SAN types are never validated and must not appear in issued certificates. Operators who require the previous behaviour can set `default_directory_policy = "sign-verbatim-unsafe"` in `config/acme`, accepting that the resulting certificates may contain unverified identity claims.
* sdk/helpers/docker: Migrate docker helpers from github.com/docker/docker to github.com/moby/moby. This was necessary as github.com/docker/docker is no longer maintained. Resolves GHSA-x744-4wpc-v9h2 and GHSA-pxq6-2prw-chj9.
SECURITY:
* Upgrade `cloudflare/circl` to v1.6.3 to resolve CVE-2026-1229
* Upgrade `filippo.io/edwards25519` to v1.1.1 to resolve GO-2026-4503
* acl: Fix privilege-escalation vulnerability where a `denied_parameters` constraint on the `policies` request field could be bypassed by submitting a mixed-case policy name (e.g. "Super-Admin" instead of "super-admin"). Vault now normalizes the `policies` parameter to lowercase before evaluating `allowed_parameters`/`denied_parameters` constraints.
* api/auth/gcp: Update go.opentelemetry.io/otel/sdk to fix CVE-2026-39883.
* api/auth: Update github.com/go-jose/go-jose to fix security vulnerability CVE-2026-34986 and GHSA-78h2-9frx-2jm8.
* api: Update golang.org/x/net to resolve GO-2026-4918
* auth/aws: Fix an issue where a user may be able to bypass authentication to Vault due to incorrect caching of the AWS client
* auth/cert: Ensure that the certificate being renewed matches the certificate attached to the session.
* auth/radius: Added case_insensitive_names toggle to prevent username collisions and enable case-insensitive user handling.
* core (enterprise): Prevent policy-name canonicalization bypasses in ACL parameter restrictions.
* core/acl: Fix LIST ACL bypass where a trailing-slash request could skip a more-specific deny rule.
* core/identity: Reject wildcards in rendered identity templates.
* core/plugin: Fix plugin catalog entries restored from a raft snapshot, written through `sys/raw`, or replicated being able to run a binary outside `plugin_directory`.
* core/policy: Harden request-time ACL construction to ignore malformed legacy policy references containing path-navigation segments (`.` or `..`) so traversal-style names are never resolved or applied.
* core: Correctly remove any Vault tokens from the Authorization header when this header is forwarded to plugin backends. The header will only be forwarded if "Authorization" is explicitly included in the list of passthrough request headers.
* core: Fixed a bypass of exact-deny ACL policies where case-variant AppRole, AWS, Azure, GCP, Kubernetes, SCEP, or TPM role names, GitHub team or user policy mapping keys, certificate or CRL names, ACL/RGP/EGP policy names, or userpass usernames could evade the deny and be resolved by the backend to the same protected resource. Okta group names, LDAP and RADIUS names on mounts left in their default case-insensitive configuration, and Enterprise SCIM client names (`identity/scim/client/<name>`, where a case-variant write overwrites the existing client) are not covered by this fix and remain subject to the same bypass; avoid combining a wildcard allow with an exact deny on those mounts and paths.
* core: Resolve GHSA-j88v-2chj-qfwx by removing our dependency on github.com/jackc/pgx/v3 and github.com/jackc/pgx/v4
* core: Resolve GO-2026-4518 and GHSA-jqcq-xjh3-6g23 by upgrading to github.com/jackc/pgx/v5
* core: Update github.com/Azure/go-ntlmssp to fix security vulnerability v0.1.1.
* core: Update github.com/apache/thrift to fix security vulnerability GHSA-wf45-q9ch-q8gh
* core: Update github.com/apache/thrift to v0.24.0 to fix security vulnerability ghsa-8wv5-x4w7-5gww.
* core: Update github.com/aws/aws-sdk-go-v2/ to fix security vulnerability GHSA-xmrv-pmrh-hhx2.
* core: Update github.com/go-jose/go-jose to fix security vulnerability CVE-2026-34986 and GHSA-78h2-9frx-2jm8.
* core: Update github.com/hashicorp/go-getter to fix security vulnerability GHSA-92mm-2pjq-r785.
* core: Update github.com/jackc/pgx/v5 to fix security vulnerability GHSA-j88v-2chj-qfwx.
* core: Update go.etcd.io/etcd/client/pkg/v3 to v3.7.1 to fix security vulnerability GO-2026-6107.
* core: Update go.opentelemetry.io/otel/sdk to fix CVE-2026-39883.
* core: Update golang.org/x/crypto to v0.56.0 to fix security vulnerabilities GO-2026-6354 and GO-2026-6355.
* core: Update golang.org/x/net to resolve GO-2026-4918"
* core: Update google.golang.org/grpc to v1.83.2 to fix security vulnerability GHSA-2v4p-qf9q-27wj.
* core: Update software.sslmate.com/src/go-pkcs12 to v0.7.2 to fix security vulnerability GO-2026-5052.
* core: Use constant-time recovery token comparison.
* core: Validate both `path` and `file_path` cannot be empty for requests to `sys/audit/{path}`
* core: Reject URL-encoded paths that do not specify a canonical path.
* http: Add configurable `max_token_header_size` listener option (default 8 KB) to bound the size of authentication token headers (`X-Vault-Token` and `Authorization: Bearer`), preventing a potential denial-of-service attack via oversized header contents. The stdlib-level `MaxHeaderBytes` backstop is also now set on the HTTP server. Set `max_token_header_size = -1` to disable the limit.
* identity/scim (enterprise): The `identity/entity/merge` endpoint now rejects requests that involve any SCIM-managed entity, preventing privileged operators from bypassing SCIM ownership guardrails to transfer aliases, group memberships, or policies across SCIM boundaries.
* identity: Prevent the entity batch-delete endpoint (identity/entity/batch-delete) from deleting the underlying storage of entities that belong to another namespace.
* identity: Entity name updates now reject mismatched id or external_id selectors to prevent retargeting updates to a different entity.
* sdk: Resolve GHSA-j88v-2chj-qfwx by removing our dependency on github.com/jackc/pgx/v3 and github.com/jackc/pgx/v4
* sdk: Resolve GO-2026-4518 and GHSA-jqcq-xjh3-6g23 by upgrading to github.com/jackc/pgx/v5
* sdk: Update github.com/Azure/go-ntlmssp to fix security vulnerability v0.1.1.
* sdk: Update github.com/go-jose/go-jose to fix security vulnerability CVE-2026-34986 and GHSA-78h2-9frx-2jm8.
* sdk: Update github.com/jackc/pgx/v5 to fix security vulnerability GHSA-j88v-2chj-qfwx.
* sdk: Update golang.org/x/net to resolve GO-2026-4918"
* secrets/spiffe (enterprise): Ensure template values are properly escaped.
* transform (enterprise): Add appropriate db specific quoting and escaping.
* ui: Upgrade dompurify to 3.4.0
* ui: Disable scarf analytics for ui builds.
* vault/sdk: Upgrade `cloudflare/circl` to v1.6.3 to resolve CVE-2026-1229
* vault/sdk: Upgrade `go.opentelemetry.io/otel/sdk` to v1.40.0 to resolve GO-2026-4394
CHANGES:
* License: Add Agentic IAM terms to client licensing model and update terms for Vault Platform licensing model.
* api: Removed the `hcp_link_status` and `hcp_link_resource_ID` fields from the `sys/seal-status` response.
* audit: A new top-level key called `supplemental_audit_data` can now appear within audit entries of type "response" within the request and response data structures. These new fields can contain data that further describe the request/response data and are mainly used for non-JSON based requests and responses to help auditing. The `audit-non-hmac-request-keys` and `audit-non-hmac-response-keys` apply to keys within `supplemental_audit_data` to remove the HMAC of the field values if so desired.
* auth/alicloud: Update plugin to [v0.24.0](https://github.com/hashicorp/vault-plugin-auth-alicloud/releases/tag/v0.24.0)
* auth/azure: Update plugin to [v0.25.1](https://github.com/hashicorp/vault-plugin-auth-azure/releases/tag/v0.25.1)
* auth/cf: Update plugin to [v0.24.0](https://github.com/hashicorp/vault-plugin-auth-cf/releases/tag/v0.24.0)
* auth/gcp: Update plugin to [v0.24.1](https://github.com/hashicorp/vault-plugin-auth-gcp/releases/tag/v0.24.1)
* auth/jwt: Update plugin to [v0.27.1](https://github.com/hashicorp/vault-plugin-auth-jwt/releases/tag/v0.27.1)
* auth/kerberos: Update plugin to [v0.18.0](https://github.com/hashicorp/vault-plugin-auth-kerberos/releases/tag/v0.18.0)
* auth/kubernetes: Update plugin to [v0.25.0](https://github.com/hashicorp/vault-plugin-auth-kubernetes/releases/tag/v0.25.0)
* auth/oci: Update plugin to [v0.22.0](https://github.com/hashicorp/vault-plugin-auth-oci/releases/tag/v0.22.0)
* auth/saml: Update plugin to [v0.9.0](https://github.com/hashicorp/vault-plugin-auth-saml/releases/tag/v0.9.0)
* auth/token: JWT revocation via `auth/token/revoke-self` and `auth/token/revoke-accessor` is no longer supported. `auth/token/revoke` and `auth/token/revoke-orphan` now require the full JWT to revoke an OAuth JWT and reject the internal stored JWT ID form. Non-JWT Vault token behavior is unchanged.
* cli: `vault operator diagnose` no longer runs an HCP Link connectivity check, and `vault status` no longer shows HCP Link status.
* cli/status: `vault status` no longer forces the root namespace when querying seal status. It now respects the namespace set via `VAULT_NAMESPACE` or the `-namespace` flag, consistent with other CLI commands.
* core/acl: LIST requests with a trailing slash now correctly respect more-specific deny policies. Previously, a deny on `path "kv/*" { deny }` could be bypassed for `LIST kv/private/` if a broader allow `path "kv/*"` also existed. Policies relying on the previous (incorrect) behavior may now be denied.
* core/managed-keys (enterprise): The response to API endpoint GET sys/managed-keys/:type/:name now
returns an array of string values for key usages, rather than an array of integer values. The strings used are 'encrypt' (1), 'decrypt' (2), 'sign' (3), 'verify' (4), 'wrap' (5), 'unwrap' (6), 'generate_random' (7), and 'mac' (8).
* core/oauth-resource-server (enterprise): The write response for `sys/config/oauth-resource-server/:name` now returns HTTP 200 with the full profile object instead of HTTP 204 with an empty body. Validation warnings are returned alongside the profile data rather than in place of it.
* core/plugin: Plugin catalog entries are now checked against `plugin_directory` whenever they are used, not only at registration. An entry whose command resolves outside the directory, including through a symlink, is refused with `plugin command is outside of configured plugin directory`, and mounts that use it are skipped at startup while keeping their data. Such plugins must be registered again with their binary inside `plugin_directory`.
* core/policy: Vault now validates policy names with segment-aware checks. Empty names and names containing `.` or `..` path segments are rejected for new policy writes and assignments, while names containing `/` and `\` remain supported. During request-time ACL construction, legacy traversal-style policy references are not applied (treated as invalid and unresolved), which can reduce effective token permissions. Operators should audit and rename affected policies before upgrading.
* core/raft: Limited concurrent retry-join workers to 20. Any further retry-join attempts while 20 are in progress will result in an error (`too many concurrent raft retry joins in progress`).
* core: ACL and Sentinel EGP rule paths targeting a specific AppRole, AWS, Azure, GCP, Kubernetes, SCEP, or TPM role, GitHub team or user policy mapping key, certificate or CRL name, ACL/RGP/EGP policy name, or userpass username are now matched against the lowercased resource name, since these backends resolve those names case-insensitively. A rule written with a mixed-case resource name (for example `auth/approle/role/MyRole`) no longer matches requests for that resource and must be rewritten using the lowercase name (`auth/approle/role/myrole`). The lowercased form is also what Sentinel RGP and EGP policies observe as `request.path`, so policy rules that compare that value against a mixed-case path (for example `request.path is "auth/approle/role/MyRole"`) must be updated as well. External auth and secret plugins are not affected by this normalization and continue to receive requests with their original casing. Existing deny rules using mixed-case resource names will fail open (become allow-all) after upgrade until rewritten with lowercase names.
* core: Bump Go version to 1.27.1.
* core: Require sudo capability for `sys/mounts/auth/<path>/tune`, matching `sys/auth/<path>/tune`.
* core: Vault now rejects paths that are not canonical, such as paths containing double slashes (`path//to/resource`)
* core: Vault will now redirect non-canonicalized paths (containing `/./`, `/../`, or `//`) to a cleaned path, instead of rejecting these requests
* core: bump github.com/hashicorp/cap to v0.12.0
* core: remove support for duplicate attributes in HCL configuration files and policy definitions. Parsing HCL with duplicate attributes now always fails, and the VAULT_ALLOW_PENDING_REMOVAL_DUPLICATE_HCL_ATTRIBUTES environment variable that previously restored the legacy behavior has been removed.
* core: secondary DR requests can now be authenticated using a root token generated on the primary.
* core: sys/generate-root and sys/replication/dr/secondary/generate-operation-token endpoints are now authenticated by default, with the old unauthenticated behaviour enabled by setting the new HCL config key enable_unauthenticated_access to include the value "generate-root" or "generate-operation-token" respectively.
* core: sys/rekey endpoints are now authenticated by default, with the old unauthenticated behaviour enabled by setting the new HCL config key enable_unauthenticated_access to include the value "rekey".
* core: Removed support for HCP Link, which connected self-managed Vault clusters to the HashiCorp Cloud Platform (HCP). Vault no longer starts an HCP Link connection, and the `cloud` stanza in the server configuration no longer has any effect and will be unrecognized.
* database/couchbase: Update plugin to [v0.17.0](https://github.com/hashicorp/vault-plugin-database-couchbase/releases/tag/v0.17.0)
* database/elasticsearch: Update plugin to [v0.21.0](https://github.com/hashicorp/vault-plugin-database-elasticsearch/releases/tag/v0.21.0)
* database/mongodbatlas: Update plugin to [v0.18.0](https://github.com/hashicorp/vault-plugin-database-mongodbatlas/releases/tag/v0.18.0)
* database/redis-elasticache: Update plugin to [v0.9.1](https://github.com/hashicorp/vault-plugin-database-redis-elasticache/releases/tag/v0.9.1)
* database/redis: Update plugin to [v0.9.0](https://github.com/hashicorp/vault-plugin-database-redis/releases/tag/v0.9.0)
* database/snowflake: Update plugin to [v0.17.0](https://github.com/hashicorp/vault-plugin-database-snowflake/releases/tag/v0.17.0)
* http: Return 431 status code instead of 400 when token header size validation fails.
* identity/scim (enterprise): Added "allow_group_adoption" toggle to allow or forbid a SCIM client from adopting groups.
* identity/scim (enterprise): Added a check for case-duplicate identity resources which, if detected, will cause the SCIM operation to fail with an error message. To deduplicate identities, please use the `force-identity-deduplication` activation flag.
* identity/scim (enterprise): Loading SCIM clients will now test for and remove duplicate client names. SCIM clients are now properly case insensitive.
* identity/scim: Remove the SCIM activation flag; SCIM v2 endpoints are now always available without prior activation
* identity: Require `sudo` capability to invoke the identity entity merge API endpoint (`identity/entity/merge`).
* license utilization reporting (enterprise): Manual reporting bundles generated by `vault operator utilization` have a changed format. Notably they contain an array of `snapshot_records` instead of `snapshots`. The `decoded_snapshot` field in each record contains the human-readable data that was previously in the `snapshots` array.
* mfa/duo: Upgrade duo_api_golang client to 0.2.0 to include the new Duo certificate authorities
* oauth-resource-server: Prevent issuer_id from being mutated after OAuth Resource Server profile creation. Operators must delete and recreate profiles to change the issuer_id.
* oauth-resource-server: Prevent unique_id_claim from being mutated after OAuth Resource Server profile creation. Operators must delete and recreate profiles to change the unique_id_claim.
* oauth-resource-server: The OAuth Resource Server feature no longer requires activation via the `sys/activation-flags/oauth-resource-server/activate` endpoint.
* oauth-resource-server: Update OAuth Resource Server config to include custom claim options for the token's unique identifier and actor.
* packaging: Container images are now exported using a compressed OCI image layout.
* packaging: UBI container images are now built on the UBI 10 minimal image.
* secrets/ad: Update plugin to [v0.23.0](https://github.com/hashicorp/vault-plugin-secrets-ad/releases/tag/v0.23.0)
* secrets/alicloud: Update plugin to [v0.23.0](https://github.com/hashicorp/vault-plugin-secrets-alicloud/releases/tag/v0.23.0)
* secrets/azure: Update azure enterprise secrets plugin to include static roles.
* secrets/azure: Update plugin to [v0.28.3+ent](https://github.com/hashicorp/vault-plugin-secrets-azure/releases/tag/v0.28.3+ent)
* secrets/gcp: Update plugin to [v0.25.0](https://github.com/hashicorp/vault-plugin-secrets-gcp/releases/tag/v0.25.0)
* secrets/gcpkms: Update plugin to [v0.25.0](https://github.com/hashicorp/vault-plugin-secrets-gcpkms/releases/tag/v0.25.0)
* secrets/keymgmt: Update plugin to [v0.20.1+ent](https://github.com/hashicorp/vault-plugin-secrets-keymgmt/releases/tag/v0.20.1+ent)
* secrets/kmip: Update plugin to v0.20.0
* secrets/kubernetes: Update plugin to [v0.14.0](https://github.com/hashicorp/vault-plugin-secrets-kubernetes/releases/tag/v0.14.0)
* secrets/kv: Update plugin to [v0.27.0](https://github.com/hashicorp/vault-plugin-secrets-kv/releases/tag/v0.27.0)
* secrets/ldap (enterprise): Static roles will be migrated from a plugin-managed queue to the Vault Enterprise Rotation Manager system. Static role migration progress can be checked and managed through a new static-migration endpoint. See the [LDAP documentation](https://developer.hashicorp.com/vault/docs/secrets/ldap#static-role-migration-to-rotation-manager) for more details on this process.
* secrets/mongodbatlas: Update plugin to [v0.18.0](https://github.com/hashicorp/vault-plugin-secrets-mongodbatlas/releases/tag/v0.18.0)
* secrets/openldap: Update plugin to [v0.19.3+ent](https://github.com/hashicorp/vault-plugin-secrets-openldap/releases/tag/v0.19.3+ent)
* secrets/pki: sign-verbatim endpoints no longer ignore basic constraints extension in CSRs, using them in generated certificates if isCA=false or returning an error if isCA=true
* secrets/ssh: RSA key sizes are now limited to a maximum size of 8192 bits addressing CVE-2026-39829
* secrets/terraform: Update plugin to [v0.15.0](https://github.com/hashicorp/vault-plugin-secrets-terraform/releases/tag/v0.15.0)
* secure-plugin-api: Update to v0.2.0
* storage: Upgrade aerospike client library to v8.
* ui/secrets: Secrets engines url paths renamed from '/secrets' to '/secrets-engines'
* ui: Remove HCP Link status indicator following deprecation of HCP Link.
* ui: Remove ability to bulk delete secrets engines from the list view.
FEATURES:
* **Transform FF1 Support (Enterprise)**: Add support for the NIST approved FF1 format preserving encryption (FPE) algorithm, and a new rewrap operation to assist transitioning
from FF3-1 to FF1.
* **PKI External CA (Enterprise)**: A new plugin that provides the ability to acquire PKI certificates from Public CA providers through the ACME protocol
* **AI Agent Support (Beta/Enterprise)**: Adds beta support for first-class AI agents. Adds an Agent Registry to register agents, and adds support for using Vault as an OAuth resource server for registered agent entities. When configured, allows OAuth 2.0 JWTs to be used to directly authorize requests to Vault, without needing a Vault token.
* **AI Agent Support (Enterprise)**: Vault's support for first-class AI agents is now Generally Available. Adds an Agent Registry to register agents, and adds support for using Vault as an OAuth resource server for registered agent entities. When configured, allows OAuth 2.0 JWTs to be used to directly authorize requests to Vault, without needing a Vault token.
* **Agent Registry UI (Enterprise)**: Adds a new Agentic Security section to the primary navigation with an Agent Registry page where operators can view, search, and manage registered AI agents, their associated Vault entities and aliases, assigned policies, and operational status.
* **Automatic DNS-01 Challenge Fulfillment for PKI External CA**: Integrate with the following DNS providers for automatic DNS-01 challenge fulfillment: AWS Route53, Azure DNS, Google Cloud DNS, and BIND and other RFC2136-compliant servers.
* **Automatic TLS Certificate Reloading**: TCP listeners accept a new `tls_reload_interval` option. When set, Vault periodically checks `tls_cert_file` and `tls_key_file` for changes and reloads the certificate automatically, so rotated certificates are picked up without restarting the node or sending SIGHUP.
* **Billing metrics dashboard**: Create a new billing dashboard with responsive layout to display metric data.
* **Dark Mode (beta)**: Added dark mode support to the Vault UI. Users can now choose between light, dark, or system-preferred themes from the Appearance section in user preferences.
* **Health Check Manager**: Adds a dedicated system to manage and monitor the health of Vault Enterprise plugins. This provides operators and platform engineers with an explicit mechanism to verify connectivity and authentication against external systems.
* **IBM PAO License Integration**: Added IBM PAO license support, allowing usage of Vault Enterprise with an IBM PAO license key. A new configuration stanza `license_entitlement` is required in the Vault config to use an IBM license. For more details, see the [License documentation](https://developer.hashicorp.com/vault/docs/license#ibm-pao-license-keys).
* **KMIP Bring Your Own CA**: Add new API to manage multiple CAs for client verification and make it possible to import external CAs.
* **LDAP Secrets Engine Enterprise Plugin**: Add the new LDAP Secrets Engine Enterprise plugin. This enterprise version adds support for self-managed static roles and Rotation Manager support for automatic static role rotation. New plugin configurations can be set as "self managed", skipping the requirement for a bindpass field and allowing static roles to use their own password to rotate their credential. Automated static role credential rotation supports fine-grained scheduled rotations and retry policies through Vault Enterprise.
* **LDAP Secrets Engine Rotate on Read (Enterprise)**: Add rotate-on-read support for static roles in the LDAP secrets engine, triggering an immediate credential rotation on read, with a configurable cooldown period and per-role override.
* **Login MFA TOTP Self-Enrollment (Enterprise)**: Simplify creation of login MFA TOTP credentials for users, allowing them to self-enroll MFA TOTP using a QR code (TOTP secret) generated during login. The new functionality is configurable on the TOTP login MFA method configuration screen and via the `enable_self_enrollment` parameter in the API.
* **ML-DSA Support in PKI**: Add support for post-quantum signatures with ML-DSA keys in the PKI secrets engine.
* **Namespace (Enterprise)**: Add `operator_namespace_path` to listener configuration to restrict HTTP access to a specific namespace subtree, enabling per-listener namespace isolation.
* **PKI BYOK CA Key Migration (enterprise)**: A new sudo-protected `POST /pki/keys/:uuid/export` endpoint wraps a CA private key with a caller-supplied public key using RSA-OAEP-SHA256, ECDH-ES, or ML-KEM. The destination Vault instance can import the blob via `POST /pki/keys/import` using `wrapped_key` and `export_key_hmac`. Export events are recorded as tamper-evident audit records keyed on the SPKI fingerprint of the CA key, which survive delete-and-reimport cycles and surface as warnings on issuer reads.
* **PKI PKCS#12 and JKS Support**: Adds support for PKCS#12 (PFX) and Java keytool (JKS) certificate bundles to relevant PKI endpoints. Bundles are returned as base64-encoded, password-protected files.
* **PKI Secure Key Export (Enterprise)**: Add export key management CRUD endpoint (LIST/WRITE/READ/DELETE /pki/export) to support secure CA private key migration between PKI mounts.
* **Plugins (Enterprise)**: Allow overriding pinned version when creating and updating database engines
* **Plugins (Enterprise)**: Allow overriding pinned version when enabling and tuning auth and secrets backends
* **Rotation Policies**: Add support for automated rotation parameters to rotation policies
* **SCIM 2.0 Identity Provisioning Beta (Beta/Enterprise)**: Adds beta support for Vault to act as a SCIM 2.0 server, allowing external management of Vault entities, aliases and groups.
* **SCIM Token Support (Enterprise)**: Add support for SCIM tokens via `token_type=scim` with per-client active token limits and max TTL ceilings.
* **SLH-DSA support for Hybrid sign/verify in Transit engine (Enterprise)**: Add support for SLH-DSA as the PQC component for Hybrid sign/verify operations. This is compatible with both ECDSA (p-256, P-384, P-521) and Ed25519.
* **Secrets Sync UI**: Added Workload Identity Federation (WIF) support in the UI for AWS, Azure, and GCP sync destinations
* **Secrets Sync UI**: Adds support to sync Database static roles
* **Secrets Sync UI**: Implements AWS KMS key ID and regional KMS keys support
* **Secrets Sync UI**: Implements GCP replica regions and encryption support
* **Secrets engines UI catalog revamp**: Redesigned view of secrets engines catalog when enabling an engine, adding more engine descriptors & ability to search the catalog for the ideal engine to utilize.
* **Telemetry Consent Banner**: Add a consent banner allowing users to accept or decline anonymous usage data collection to help improve Vault.
* **Template Integration for PublicPKICA**: Vault Agent templates are now automatically re-rendered when a PKI external CA certificate is issued or renewed.
* **Terraform Code Generator**: Adds TFVP code snippets to ACL policy surfaces (show, flyout and form), powered by a new reusable mapping engine for generating HCL from Vault API payloads.
* **Transit Crypto Agility**: Allows customers to alter cryptographic primitives in transit engine. This adds new endpoints `/transit/keys/:name/algorithm` and `/transit/keys/:name/import_version`.
* **UI ACL Policies intro**: Onboarding intro which provides feature context to users.
* **UI Authentication methods intro**: Onboarding intro which provides feature context to users.
* **UI Namespace Wizard (Enterprise)**: Onboarding wizard which provides advice to users based on their intended usage and guides them through namespace creation.
* **UI Policy Generator (Enterprise)**: Adds policy generator flyout to KV V2 and PKI secrets engines prepopulated with relevant API requests for each page.
* **UI Secret engines intro**: Onboarding intro which provides feature context to users.
* **UI TLS Certificate login**: Add UI login support for the TLS certificate (cert) authentication.
* **UI: Hashi-Built External Plugin Support**: Recognize and support Hashi-built plugins when run as external binaries
* **UI: Hashi-Built External Plugin Support**: Support external plugin version updates via the GUI.
* **UI: Mount versioned external plugins**: Adds ability to mount previously registered, external plugins and specify a version when enabling secrets engines.
* **UI: PKI External CA**: Adds views to inspect ACME orders (active orders by role, lookup by order ID or certificate), ACME account, DNS provider, and role configurations, and retrieve cached certificates.
* **User Preference Settings**: Added a User Preferences page (`/vault/<cluster>/user-preferences`) accessible from the account menu. Includes a Data & Privacy section with a telemetry consent toggle that persists per-browser in localStorage.
* **Vault Agent: ACME protocol support**: Add support to natively support Public CA ACME workflows
* **Vault Client (Enterprise)**: Introduce `vault-client`, a smaller binary that includes Vault Agent, Vault Proxy, and the CLI commands for interacting with a Vault server, but not the server itself. It is available as zip bundles and Alpine container images.
* **oauth-resource-server**: Added `oauth_denylist.entries.gauge` metric to monitor active OAuth token denylist entries.
* **secrets-sync (enterprise)**: Added support for the Database secrets engine as a sync source, allowing static-role credentials to be synced to external destinations.
* oauth-resource-server: Added OAuth Protected Resource Metadata endpoint (RFC 9728) for publishing authorization_details types and enabling automated discovery by Authorization Servers via /.well-known/oauth-protected-resource
* secrets-sync: implemented workload identity federation support for secrets sync flows.
* secrets: Added ability to view secrets in YAML format
IMPROVEMENTS:
* **Secrets Engines UI improvement**: Updated configuration views and added tune support for configurations across all compatible secrets engines.
* **Sidebar UI improvement**: Add top navbar, update sidebar navigation structure, and update page headers.
* Update github.com/dvsekhvalnov/jose2go to fix security vulnerability CVE-2025-63811.
* activity (enterprise): Add a cumulative namespace client count API at `sys/internal/counters/activity/cumulative`. For each namespace in the response it returns the sum of its own client counts and that of all its child namespaces.
* agent-registry (enterprise): Add a `local` flag to agent registrations. When `local=true`, registrations are not replicated to other performance replication clusters and are kept local to the current cluster.
* agent-registry (enterprise): Removed the restriction that disallowed the use of 'deny' in ceiling policies, resulting in request errors.
* agent/pkiexternalca: Replace go.uber.org/atomic with sync/atomic (stdlib) for atomic boolean operations in the pkiexternalca package.
* api: Add `start_month` and `end_month` parameters to `/sys/billing/overview` endpoint to allow querying billing data for specific time ranges.
* api: Add a SHA256 sum field to the json list response for external plugins.
* api: Add migration_done_at_epoch to sys/seal-status response.
* api: Added sudo-permissioned `sys/reporting/scan` endpoint which will output a set of files containing information about Vault state to the location specified by the `reporting_scan_directory` config item.
* auth/aws: Added missing OpenAPI metadata for the aws auth endpoints
* auth/aws: Migrate the AWS auth method, its public API client (`api/auth/aws`), and the shared login-data helper (`internal/awsutil/v2`) from AWS SDK for Go v1 to v2.
* auth/cert: Support login via x-forwarded cert headers even with tls disabled on the vault listener.
* auth/jwt (OAuth RS): Add EdDSA/Ed25519 support to the OAuth resource server JWT validation path. Ed25519 public keys can now be registered via `public_keys` and `supported_algorithms = ["EdDSA"]` is now accepted at configuration time and runtime.
* auth/jwt: Add parameter constraint fields (allowed_parameters, denied_parameters, required_parameters) to vault:path_access RAR type schema and metadata for complete OAuth Resource Authorization Request support
* auth/ldap: Require non-empty passwords on login command to prevent unauthenticated access to Vault.
* auth/okta: Add missing OpenAPI path description for the /auth/{okta_mount_path}/verify/{nonce} path.
* auth/okta: Added missing OpenAPI metadata for auth Okta plugin endpoints
* auth/spiffe (enterprise): Add SPIFFE login cli handler.
* auth/token: Add global denylist for revoking OAuth JWTs to prevent authorization of specific tokens across all namespaces.
* auth/token: Add the `revoke-oauth` endpoint to revoke an external OAuth token by its issuer and unique ID.
* auth/token: auth/token/revoke-accessor now supports revoking JWT tokens by accessor
* ci (enterprise): Upload build stage duration metrics to Instana for CI observability.
* cli: Move spiffe and tpm CLI login methods to CE.
* command/agent: Migrate AWS client from aws-sdk-go v1 to aws-sdk-go-v2.
* config/listener: logs warnings on invalid x-forwarded-for configurations.
* consumption-billing: Add a new `sys/billing/config` endpoint to allow configuration of billing data retention (min 13 months, max 6 years).
* consumption-billing: Add billing tracking for LDAP and OpenLDAP service account
library sets as part of both HWM role metrics and running-count product usage metric.
* consumption-billing: Add billing tracking for OS Local Account static roles to support consumption-based billing metrics and high-water mark (HWM) tracking.
* consumption-billing: Added consumption billing metrics for GCP KMS data protection operations.
* consumption-billing: Added consumption billing metrics for OIDC tokens.
* consumption-billing: Added consumption billing metrics for PKI External CA certificates.
* consumption-billing: Added consumption billing metrics for SPIFFE JWT tokens.
* consumption-billing: Adds a new `sys/billing/overview` endpoint that returns current and previous month consumption billing metrics. Accessible via API client method `client.Sys().BillingOverview()`.
* consumption-billing: Enabled `sys/billing/overview` endpoint in admin namespace.
* consumption-billing: Float64 values returned by `sys/billing/overview` are now rounded to 4 decimal places.
* consumption-billing: Increased billing data retention from 2 months to 37 months. The `/sys/internal/billing/overview` API endpoint now returns 37 months of historical consumption billing data by default.
* consumption-billing: Mount attribution data is now stored for consumption billing metrics. The retention period can be configured via the new `attribution_retention_months` parameter on `sys/billing/config` (0–72 months, default 37). Setting to 0 disables attribution storage and immediately wipes all existing attribution data.
* consumption-billing: The `/sys/internal/billing/overview` API endpoint now always returns all metric types in the response, even when their values are zero. This ensures consistent response structure for easier client-side parsing.
* core (enterprise): Make deadlock detection in sealwrap configurable by adding "sealwrap" to existing configuration detect_deadlocks.
* core (enterprise): Sanitized config now shows kms_library config.
* core (enterprise): Add OAuth resource server authorization_details type discovery endpoints and align vault:path_access claim matching semantics with path/capabilities evaluation; discovery endpoints are unauthenticated.
* core (enterprise): Add `disallow_env_vars` in PKCS#11 to allow per key configuration for RSA encryption algorithm.
* core (enterprise): Add `sys/config/ui/checklist-state` endpoint to persist and retrieve onboarding checklist progress.
* core (enterprise): Add an endpoint at `sys/config/oauth-resource-server/id/:config_id` to read oauth resource server profiles by `config_id`
* core (enterprise): Add common_criteria_mode feature_flags setting which limits listener TLS cipher suites.
* core (enterprise): Added a new telemetry metric `vault.core.license.termination_time_epoch`.
* core (enterprise): Make OAuth resource server JWT `typ` validation more permissive for tokens from IdPs such as Okta by allowing a missing `typ` header, while restricting present `typ` values to `at+jwt`, `application/at+jwt`, and `JWT`.
* core (enterprise): allow secretmounts' seal wrap configuration to be changed via auth and/or mount tune instead of only at mount creation.
* core (enterprise): enable rotation manager to send rotation information required by plugin backends during registration and rotation operations. This allows plugin backends to have the necessary context for managing their rotation state effectively.
* core (enterprise): enable rotation manager to use configurable retry policies to limit the retry behavior for rotation entries and include an orphaning mechanism to handle entries that exceed the maximum retry attempts.
* core (enterprise): improve rotation manager error handling by implementing a backoff when re-queueing failed rotations
* core (enterprise): Ameriolate sealwrap lock contention for core paths.
* core/acl: Adds a global `deny_slash_in_templated_path` configuration option to reject the presence of slashes in rendered identity templates in policies, defaulting to `false`.
* core/census: Add `vault.secret.engine.transform.role.count` product usage metric reporting the number of Transform secret engine roles.
* core/census: Add product usage metrics `vault.auth.method.cert.role.count`, `vault.auth.method.cert.crl.count`, `vault.auth.method.spiffe.role.count`, and `vault.auth.method.scep.role.count` reporting the number of Cert auth roles and CRLs, SPIFFE auth roles, and SCEP auth roles across all namespaces and mounts, and `vault.auth.method.spiffe_enabled` reporting whether the SPIFFE auth method is enabled.
* core/census: Add product usage metrics reporting the number of Transform secret engine transformations, templates, alphabets, and stores, and KMIP secret engine scopes, scope roles, and CAs.
* core/identity: Add two new fields to the alias API, external_id and issuer. These fields do not inherently do anything meaningful, and are part of a future feature.
* core/identity: Adds a global `deny_slash_in_templated_path` configuration option to reject the presence of slashes in rendered identity templates in policies, defaulting to `false`.
* core/managed-keys (enterprise): Allow GCP managed keys to leverage workload identity federation credentials
* core/managed-keys/PKCS#11 (enterprise): Add PKCS#11 backend parameter `rsa_oaep_hash` to use for RSA-OAEP encryption with CKM_RSA_PKCS_OAEP mechanism.
* core/managed-keys/PKCS#11 (enterprise): Providing a non-empty value for one field while the other is already saved is rejected. To switch addressing modes, you must explicitly clear the old field by sending it as an empty string ("") in the same request alongside the new value.
* core/managed-keys/PKCS#11 (enterprise): slot and token_label are now strictly enforced as mutually exclusive identifiers for an HSM token
* core/metrics: Reading and listing from a snapshot are now tracked via the `vault.route.read-snapshot.{mount_point}` and `vault.route.list-snapshot.{mount_point}` metrics.
* core/oauth-resource-server (enterprise): Read and list responses for `sys/config/oauth-resource-server` now include a `mount_accessor` field containing the pre-assembled synthetic accessor string (`oauth-resource-server_<namespace_id>_<config_id>`). This is the accessor reported for profile-backed aliases in identity and audit output, and the value used to select those aliases in templated policies.
* core/oauth-resource-server (enterprise): Support setting an alternate claim name in an OAuth Resource Configuration specifying where to read authorization details in a presented JWT. New option "authorization_details_claim" defaults to "authorization_details".
* core/oauth-resource-server (enterprise): The list response for `sys/config/oauth-resource-server` now includes a `key_info` map keyed by profile name, each entry carrying `config_id` and `mount_accessor`. Listed profile names are now sorted, and profiles whose details cannot be read are reported in a response warning.
* core/oauth-resource-server: Support data locality for OAuth Resource Server configuration profiles (non-replicated profiles).
* core/seal (enterprise): Make it possible for new nodes to join a cluster configured with Seal High Availability.
* core/seal (enterprise): Update Oracle Cloud library to enable seal integration with newer regions.
* core/seal: Enhance sys/seal-backend-status to provide more information about seal backends.
* core: Add a `ui_settings` configuration stanza with a `ui_telemetry` option, surfaced to the UI via the `sys/internal/ui/settings` endpoint, that gates anonymous UI usage telemetry.
* core: Automatically write a goroutine dump to a temp directory on shutdown (SIGTERM/SIGINT). The output directory can be overridden with `VAULT_STACKTRACE_FILE_PATH`, and the dump can be suppressed with the config field `disable_goroutine_trace_dump`.
* core: Enforce OAuth authorization_details vault:path_access constraints with strict path/capabilities and parameter-level controls.
* core: Improve goroutine termination during preseal.
* core: check rotation manager queue every 5 seconds instead of 10 seconds to improve responsiveness
* dockerfile: container will now run as vault user by default
* events (enterprise): Add event notifications support for lease events.
* events (enterprise): Forward event notifications from primary to secondary clusters
* events: Add `VAULT_EVENT_NOTIFICATIONS_BOUNDED_QUEUE_SIZE` environment variable to configure bounded event queues for event notification subscribers. Set to a positive integer (e.g., 16) to enable buffered channels of that size (maximum 1000). This prevents resource exhaustion in deployments with high subscriber counts, but comes at the cost of the potential for subscribers to miss events. Defaults to 0 (unbuffered) for backward compatibility.
* events/sqs: Migrate SQS event subscription plugin from aws-sdk-go v1 to aws-sdk-go-v2.
* go: update to golang/x/crypto to v0.45.0 to resolve GHSA-f6x5-jh6r-wrfv, GHSA-j5w8-q4qc-rx2x, GO-2025-4134 and GO-2025-4135.
* identity/entity-alias: Added `profile_name` and `config_id` fields as shortcuts to resolve an OAuth Resource Server profile when creating entity aliases, without requiring a `mount_accessor`. Resolving a profile also binds the alias to that profile's issuer, which OAuth Resource Server authentication requires. The fields are mutually exclusive with each other and with `mount_accessor`.
* identity/scim (enterprise): Add `POST identity/scim/client/<client-name>/link-entity` endpoint to re-establish SCIM ownership over an unmanaged entity, restoring managed aliases and group memberships.
* identity/scim (enterprise): Add `POST identity/scim/client/<client-name>/link-group` and `POST identity/scim/client/<client-name>/unlink-group` admin endpoints. `link-group` transfers ownership of an existing unmanaged Vault identity group to the named SCIM client; all current group members must already be owned by that client. `unlink-group` removes SCIM ownership from a group the client currently owns, returning it to unmanaged status.
* identity/scim (enterprise): Add `POST identity/scim/client/<client-name>/unlink-entity` endpoint to remove the SCIM ownership link from an entity without deleting it.
* identity/scim (enterprise): Add `allow_user_adoption` field to SCIM client configuration. When set to `true`, a `POST /Users` request whose `userName` matches an existing login alias will adopt the pre-existing entity rather than returning a conflict. Defaults to `false`.
* identity/scim (enterprise): Add support for `attributes` and `excludedAttributes` query parameters on SCIM User and Group endpoints, allowing callers to request a subset or exclusion of attributes in responses per RFC 7644.
* identity/scim (enterprise): Added filtering support to the `GET /scim/v2/Users` and `GET /scim/v2/Groups` endpoints per RFC 7644. Supported filters: `userName eq`, `externalId eq`, `active eq`, and `meta.lastModified gt/ge/lt/le` for Users; `displayName eq` and `meta.lastModified gt/ge/lt/le` for Groups. Unsupported filter expressions return HTTP 400. `ServiceProviderConfig` now advertises `filter.supported: true`.
* identity/scim (enterprise): Fix Group PATCH to support filtered member paths of the form `members[value eq "uuid"]` for `add` and `replace` operations, matching the path format already supported for `remove`. This resolves an Okta error ("unsupported path") during Group Push membership updates. Group ownership mismatches now return 403 Forbidden (previously 404 Not Found); attempting to add/replace members owned by a different SCIM client now returns 403 (previously 400 with a not found-style detail).
* identity/scim (enterprise): Improve SCIM User and Group listing endpoint performance by using prefix sort instead of a separate sort pass.
* identity/scim (enterprise): Renamed the `unlink_aliases` consent parameter to `unlink_secondary_aliases` and separated the response payload into `unlinked_main_alias_id` and `unlinked_secondary_alias_ids`.
* identity/scim (enterprise): The 2.1 User extension now supports a client-managed `aliases` attribute. SCIM clients can push an array of `{mount_accessor, name}` entries on `POST`, `PUT`, and `PATCH /Users` to create, rename, or remove secondary aliases on an entity beyond the primary alias controlled by `alias_mount_accessor`.
* identity/scim (enterprise): Update PATCH operations on scim/v2/Users to allow multiple modifications in the same patch call, support for patch operations on user metadata and name in addition to active status, and allow specifying `path` value in patch operations
* identity/scim: New SCIM extensions for Users and Groups are supported, but mutually exclusive with User metadata extension.
* identity/scim: POST /Users for a client with alias_mount_accessor now adopts a pre-existing entity when the userName matches an existing login alias on the target mount, instead of failing with a conflict.
* identity/scim: Unmanaged groups (no SCIM owner) are now visible to all SCIM clients via GET /Groups and GET /Groups/<id>. Groups owned by a different client remain hidden (403 on direct read). For unmanaged groups, the members array is filtered on read to only the members owned by the requesting client.
* identity/scim: `externalId` is now optional on `POST /Users` and is no longer required to be unique within a namespace. Multiple users may share the same `externalId` value.
* identity/scim: permit adoption of unmanaged Vault groups only on PUT or PATCH SCIM requests.
* identity: Include entity status and entity/alias timestamp details in entity list key_info responses.
* jwt/oauth-resource-server: Profile resolution now walks the namespace ancestor chain, allowing a JWT whose OAuth Resource Server Configuration Profile is registered in a parent namespace to authenticate requests targeting resources in child namespaces.
* kmip (enterprise): Add experimental API to execute KMIP requests.
* license utilization reporting (enterprise): Add metrics for the number of issued PKI certificates.
* license utilization reporting (enterprise): Utilization reports now include new license metadata fields `issuer`, `edition`, `add_ons`, `license_start_time`, `license_expiration_time`, and `license_termination_time`.
* license utilization reporting: Added consumption billing metrics.
* oauth-resource-server: Add support for fine-grained policy control options (parameter constraints) in Rich Authorization Requests (RAR), including `allowed_parameters`, `denied_parameters`, and `required_parameters` inside `authorization_details`.
* oauth-resource-server: Add support for identity template expressions (e.g. `{{identity.entity.id}}`) in Rich Authorization Requests (RAR).
* oauth-resource-server: Improved error body returned when permission is denied by ceiling policies to indicate that ceiling policies were what denied the request (`CEILING_POLICY_DENIED`).
* pki: Reject obviously unsafe validation targets during ACME HTTP-01 and TLS-ALPN-01 challenge verification
* policies: add warning about list comparison when using allowed_parameters or denied_parameters
* product usage reporting (enterprise): Add `vault.secure_hub_connected` Census product usage metric to report whether a cluster is connected to the Secure Hub.
* rotation: Ensure rotations for shared paths only execute on the Primary cluster's active node. Ensure rotations for local paths execute on the cluster-local active node.
* scim: The SCIM Group PATCH handler now supports the path field in the form members[value eq "id"] on remove operations.
* scim: User resources now include a read-only `groups` field listing the direct group memberships managed by the requesting SCIM client, per RFC 7643.
* sdk/helper/keysutil: The lock manager's GetPolicy function now always returns a locked Policy, even when caching is enabled. The PolicyRequest struct has a new field to indicate whether the caller requires a write lock on the policy.
* sdk/rotation: Prevent rotation attempts on read-only storage
* sdk: Add NewTestDockerCluster support for running external plugins within the same container as the server. Also add support for those plugins to expose their own listeners, as KMIP does.
* sdk: Add alias_metadata to tokenutil fields that auth method roles use.
* sdk: Expand support for docker test cluster options like seals, kms libraries, and entropy augmentation. DockerClusterNode.UpdateConfig now takes a full set of cluster options instead of just node config.
* sdk: add WIF and rotation helpers for checking if params were updated to allow the consumer to know when changes need to be persisted to storage
* secret-sync (enterprise): Added telemetry counters for reconciliation loop operations, including the number of corrections detected, retry attempts, and operation outcomes (success or failure with internal/external cause labels).
* secret-sync (enterprise): Added telemetry counters for sync/unsync operations with status breakdown by destination type, and exposed operation counters in the destinations list API response.
* secret-sync: add parallelization support to sync and unsync operations for secret-key granularity associations
* secrets import: Add support for `allowed_ipv4_cidrs` in `source_aws` and `source_azure` configuration blocks to allow connections to explicitly permitted private IPv4 ranges.
* secrets-pki (enterprise): Add response data in a parsed format to the audit log for enrollment protocols.
* secrets-sync (enterprise): Added support for a boolean force_delete flag (default: false). When set to true, this flag allows deletion of a destination even if its associations cannot be unsynced. This option should be used only as a last-resort deletion mechanism, as any secrets already synced to the external provider will remain orphaned and require manual cleanup.
* secrets-sync (enterprise): Improved the user experience during mount lifecycle changes by triggering immediate unsyncing of external secrets when a secrets engine mount is deleted or disabled. By moving this logic from the background reconciliation loop to a direct callback, the system prevents perceived "leaks" and ensures external secret resources are cleaned up synchronously with the Vault unmount.
* secrets-sync: Adds support for customer-controlled (CSP Managed) encryption in secrets sync flows for AWS destination.
* secrets/aws: Added missing OpenAPI metadata for the aws secret engine endpoints
* secrets/aws: Migrate AWS client from aws-sdk-go v1 to aws-sdk-go-v2.
* secrets/database: Add root rotation support for Snowflake database secrets engines using key-pair credentials.
* secrets/keymgmt (enterprise): Add support for multi-region AWS KMS keys.
* secrets/kmip (enterprise): Obey configured best_effort_wal_wait_duration when forwarding kmip requests.
* secrets/kv (enterprise): Support reading and recovering KVv2 secrets from a loaded snapshot, including in-place recover and copy-from-path within the same mount and namespace.
* secrets/ldap: Users can now fully manage and tune the LDAP secrets engine. This includes the ability to view, edit, and configure the LDAP engine.
* secrets/pki (enterprise): Allow SCEP to use an issuer that is backed by an RSA based PKCS#11 managed key
* secrets/pki (enterprise): Return the POSTPKIOperation capability within SCEP GetCACaps endpoint for better legacy client support.
* secrets/pki (enterprise): Validate entire chain in common criteria mode; add field to enable time checks on validation
* secrets/pki (enterprise): When the common_criteria_mode feature flag is enabled, NotBefore will always be treated as zero.
* secrets/pki (enterprise): When the common_criteria_mode feature flag is enabled, enforce a minimum set of key usages for each ext key usage set based on RFC 5280 Section 4.2.1.12 during PKI role updates.
* secrets/pki: Add ACME configuration fields challenge_permitted_ip_ranges and challenge_excluded_ip_ranges configuration to control which IP addresses are allowed or disallowed for challenge validation.
* secrets/pki: Add Freshest CRL extension (Delta CRL Distribution Points) to base CRLs
* secrets/pki: Add `extra_subject_names_oids` field to roles to allow specifying additional OID subject name components.
* secrets/pki: Avoid loading issuer information multiple times per leaf certificate signing
* secrets/pki: Include the certificate's AuthorityKeyID in response fields for API endpoints that issue, sign, or fetch certs.
* secrets/pki: OCSP populate details of the response within the new `supplemental_audit_data` section of audit log response entries. Details such as issuer_id, next_update, ocsp_status, serial_number, revoked_at will appear as hmac values by default unless added to the mount's `audit-non-hmac-response-keys` set of keys.
* secrets/pki: add an additional field to include a RFC 5280 revocation reason for (/pki/revoke) and (/pki/revoke-with-key).
* secrets/pki: when in common criteria mode, don't allow upload of certificates without a chain of trust.
* secrets/transit (enterprise): Implement OAEP/PKCS1v15 padding support to encrypt/decrypt operations for managed keys.
* secrets/transit, core: Boost the limit of random bytes retrievable via random byte APIs. And add the option to get PRNG random bytes seeded by random sources. Note that requests for large numbers of bytes will increase Vault memory usage accordingly.
* secrets/transit: Add hash_algorithm parameter in encrypt/decrypt operations for RSA keys.
* secrets/transit: Change to using Trail of Bits libraries for PQC signature implementation in Transit
* secrets/transit: Improve import errors for non-PKCS#8 keys to clearly require PKCS#8.
* storage/dynamodb: Migrate DynamoDB storage backend from aws-sdk-go v1 to aws-sdk-go-v2.
* storage/s3: Migrate S3 physical storage backend and autosnapshot tests from AWS SDK v1 to AWS SDK v2.
* sys (enterprise): Add sys/billing/certificates API endpoint to retrieve the number of issued PKI certificates.
* token: Add debug logging for foreign server side consistent token handling
* transit (enterprise): Add context parameter to datakeys and derived-keys endpoint, to allow derived key encryption of the DEKs.
* transit (enterprise): Encryption/Decryption is now supported for managed keys for all
supported managed key backends.
* ui (enterprise): Add onboarding checklist widget to the dashboard that guides new operators through initial Vault setup steps, with progress tracking and step-level completion state.
* ui (enterprise): Agent registry nav item is now hidden based on license module is present.
* ui (enterprise): Migrate charts from Lineal to Carbon Charts in the Client usage overview and Vault usage dashboard.
* ui/activity (enterprise): Add clarifying text to explain the "Initial Usage" column will only have timestamps for clients initially used after upgrading to version 1.21
* ui/activity (enterprise): Allow manual querying of client usage if there is a problem retrieving the license start time.
* ui/activity (enterprise): Reduce requests to the activity export API by only fetching new data when the dashboard initially loads or is manually refreshed.
* ui/activity (enterprise): Support filtering months dropdown by ISO timestamp or display value.
* ui/activity: Display total instead of new monthly clients for HCP managed clusters
* ui/dashboard: Reorganized dashboard widgets to improve layout and usability. Updated widgets to use HDS table components for better consistency. Enhanced the Quick Actions card with frequently used links alongside existing actions.
* ui/pki: Adds support to configure `server_flag`, `client_flag`, `code_signing_flag`, and `email_protection_flag` parameters for creating/updating a role.
* ui/secrets-sync: Improve syncing database static roles by prefixing typed role names with "static-roles/" and linking synced roles to their correct mount path.
* ui/secrets-sync: Remove empty subtitle and breadcrumb elements from Secrets sync page headers.
* ui: Add "About this engine" section to the secrets engine mount form for KV, AWS, Azure, GCP, and Database engines.
* ui: Add "Configuration path" and "Configuration metadata path" fields to KV v2 secret paths page showing paths without /v1/ prefix for use in policies, Vault Agent configurations, and other tools that reference the logical path.
* ui: Add a "Submit feedback" button to the left navigation sidebar and the help menu dropdown that opens a feedback survey in a new tab. Available in Community, Enterprise, and HVD.
* ui: Add a read-only YAML view option to the KV v2 secret details page, alongside the existing UI and JSON views.
* ui: Add events opt-in browser telemetry, emitted to Segment when UI telemetry is enabled and the user has consented. Covers the namespace wizard, resource creation (secrets engines, auth methods, and policies), dashboard quick actions, secrets engines widget, and intro pages.
* ui: Add support for reading and recovering KV v2 secrets from snapshots. Add YAML view format option when reading from the snapshot.
* ui: Add support for self-managed LDAP static roles, including setting the account password on the create and edit pages and viewing it from the role details page.
* ui: Add test coverage asserting automation snippets remain visible when editing an existing ACL policy
* ui: Added Page::Tabs component and migrated all Hds::Tabs usages to it
* ui: Adds an onboarding intro for Entities which provides feature context to users.
* ui: Adds an onboarding intro for Groups which provides feature context to users.
* ui: Adds an onboarding intro for OIDC Provider which provides feature context to users.
* ui: After clicking Save or Discard in the unsaved changes modal, the user will now navigate to the intended destination link.
* ui: Analytics identity is now cached and applied when the user accepts the consent banner, ensuring sessions are correctly identified even when consent is granted after the cluster route loads.
* ui: Bump `@hashicorp/design-system-components` from 4.24.1 to 5.2.0 and migrate deprecated side-nav SCSS tokens.
* ui: Bump `dompurify` from `3.4.6` to `3.4.13`.
* ui: Bump dompurify to 3.4.15 to address SECVULN advisories
* ui: Bump js-yaml from 5.2.1 to 5.4.1
* ui: Bump pnpm.overrides entry for `tmp` from 0.2.6 to 0.2.7.
* ui: Bump pnpm.overrides entry for `ws` from 8.20.1 to 8.21.0.
* ui: Bump shell-quote from 1.8.4 to 1.9.0.
* ui: Cancelling an LDAP role or library edit now returns to its details page instead of the list.
* ui: Dashboard feature spotlight widget now cycles through multiple "What's New" cards with random start position and Back/Next pagination.
* ui: Display errors consistently across the application and show API messages where available.
* ui: Enable Segment analytics for self-managed Vault clusters in production
* ui: Exposing the RSA Private Key field in the UI when generating credentials with the snowflake database secrets engine. Previously, this field was only shown in the cli.
* ui: Increase list item width when adding policies to groups or entities to display longer names and add a tooltip for showing full labels.
* ui: Migrated ExternalLink component to HDS links.
* ui: Pass persona in the event payload and emit 'unknown' when no persona is set.
* ui: Refine Segment analytics provider to use cluster ID as instanceId, omit subscriptionId for community clusters. Add event tracking and prune unused event properties.
* ui: Remove unused Vercel Storybook artifacts (`vercel.json`, `metadata.json`) left over from the Storybook removal in 2022
* ui: Rename user-preferences route, components, and static assets to preferences for consistency
* ui: Replace PostHog with Segment as the sole telemetry provider for HVD clusters, and distinguish HVD versus self-managed deployments in Segment analytics traits.
* ui: Replace legacy dropdown component with HDS Dropdown in the copy secret dropdown.
* ui: Replace legacy dropdown components with HDS Dropdown in PKI issuer pages.
* ui: Scroll to top of page when loading step 3 of the namespace creation wizard
* ui: Secrets engine delete confirmation modal now requires typing `delete-engine` to confirm, displays the engine name, secret count (KV engines only), and a list of what will be permanently deleted. ConfirmModal has now been updated to include a optional type-to-confirm.
* ui: Set pagination size to 10 for custom messages list view and toggle the "Apply filters" button visibility based on filter selection.
* ui: Show a warning when a user is creating a policy without any capabilities in the policy flyout.
* ui: Supply link to UI telemetry events documentation in the UI telemetry consent banner
* ui: Track analytic event when user changes their color scheme preference
* ui: Update ACL/EGP/RGP policy, identity groups, group aliases, namespaces, and secrets engine list views.
* ui: Update Identity Entities list page with new table component and flyout details panel.
* ui: Update KV version dropdown to use HDS components.
* ui: Update autocomplete-input dropdown to use HDS dropdown component.
* ui: Update copy and styles on the user preferences page
* ui: Update copy on merge entities page to specify entity ID is the required data input when merging entities.
* ui: Update the sidenav design and add top navbar.
* ui: Updated page container alignment and max-width to reduce whitespace in large viewports
* ui: Upgrade HashiCorp Design System (HDS) to 6.5.0 and design tokens to 5.1.0.
* ui: Upgrade Path Analyzer selects latest available version by default and shows state message when the user is already up-to-date.
* ui: Upgrade Path Analyzer surfaces API errors
* ui: User Preferences page now includes a "Your role" persona selector so users can self-identify as Developer, Platform Engineer / Vault Administrator, Security Analyst, or Other.
* ui: User preferences page no longer shows the Data & Privacy (telemetry) section for HVD-managed clusters, where the Segment toggle is not applicable.
* ui: `unsafe-inline` is no longer included in the `style-src` CSP directive.
* ui: add validations to the ACL visual policy editor to prevent it from saving policies with empty paths or capabilities.
* ui: allow side navbar to be collapsible
* various: Replace use of patrickmn/go-cache with jellydator/ttlcache to have more control over the janitor goroutine that handles item expiration.
* vault/acl_util_ent vault/policy_util_ent vault/logical_system_helpers_ent: Updating github.com/hashicorp/sentinel from v0.26.3 to latest to migrate from aws-sdk-go v1 to aws-sdk-go-v2.
* vault/managed_key: Migrate AWS client from aws-sdk-go v1 to aws-sdk-go-v2.
BUG FIXES:
* Proxy/Agent: Fixed a bug where auth method headers accumulated on the shared API client across re-auth cycles.
* Proxy: Fixed a bug where the Vault token header accumulated duplicate values across WebSocket reconnects in the static secret cache updater.
* Secrets Recovery (enterprise): Do not redirect to the active node for list requests to `sys/storage/raft/snapshot-load` or read/delete requests to `sys/storage/raft/snapshot-load/{id}`. If possible, handle these requests on the performance standby, otherwise forward the requests to the active node.
* Secrets Recovery (enterprise): Fixing Vault panic in cli when running `vault recover` without a path.
* activity (enterprise): sys/internal/counters/activity outputs the correct mount type when called from a non root namespace
* agent/gcp: derive service account from `GOOGLE_APPLICATION_CREDENTIALS` instead of hardcoding `"default"` when `service_account` is not explicitly configured, fixing `Error 400: Invalid form of account ID` on Cloud Run and GCE with non-default service accounts
* agent/pki-external-ca: Fix CA chain extraction from Vault PKI API responses where `ca_chain` field was always empty in templates due to incorrect type handling of array responses
* agent/pkiexternalca: Fix token distribution to PKI system and HTTP-01 challenge server shutdown preventing certificate acquisition and retries
* agent: Fix Vault Agent discarding cached tokens on transient server errors instead of retrying
* agent: Fixed a permanent deadlock in `AuthHandler.Run` when `pki_external_ca` is configured, where token channel sends could block indefinitely after re-authentication, silently stopping all certificate renewal and template rendering.
* api: Account for the HTTP Age header when calculating a lease's remaining lifetime, so that leases read or renewed through a caching proxy such as Vault Agent are renewed before they expire.
* audit/file: The logic preventing setting of executable bits on audit devices was enforced at unseal instead of just at new audit device creation, causing an error at unseal if an existing audit device had exec permissions. The logic now warns and clears exec bits to prevent unseal errors.
* audit: Fix a regression from CVE-2025-6000 that broke enabling audit devices on Windows when a plugin directory was configured.
* audit: make file and socket audit sink serialization context-aware so canceled or expired requests stop waiting behind blocked audit writes, reducing buildup of goroutines, memory, connections, and file descriptors during audit sink contention
* auth/approle (enterprise): Fixed bug that prevented periodic tidy running on performance secondary
* auth/approle (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth/approle: Fix `token_bound_cidrs` validation when using /128 blocks for role and secret ID
* auth/aws (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth/aws: Fix a couple of cases where the role cache wasn't used, and instead we went directly to storage.
* auth/aws: fix bug where rotation and wif config updates were not persisted to storage
* auth/cert (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth/cert: Add support for x-forwarded cert headers coming from AWS ALBs.
* auth/gcp: Fix intermittent context canceled failures for Workload Identity Federation (WIF) authentication
* auth/github (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth/jwt: Fix three critical OAuth/RAR issues: authorization_details not being logged in auth section of audit logs, RAR mandatory logic incorrectly requiring both profile and registration to exist, and rar_types_metadata_endpoint path in OAuth Protected Resource Metadata
* auth/jwt: Fixed incorrect HTTP status codes returned during agent ceiling policy evaluation.
* auth/jwt: Validate the JWT `typ` from the JOSE header only, so specific header claims (like `typ`) appearing in the JWT payload are ignored from JWT Validation.
* auth/ldap (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth/okta (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth/radius (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth/scep (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth/spiffe (enterprise): Use the full peer certificate chain when verifying certificates.
* auth/spiffe: Address an issue updating a role with overlapping workload_id_pattern values it previously contained.
* auth/token: Fix bug which skipped local token state clean up on PR secondary clusters after JWT revocation
* auth/token: Fixed a bug where `auth/token/lookup` and `auth/token/lookup-self` returned 403 for JWT tokens in a non-root namespace.
* auth/token: Prevent performance secondary node from writing to the OAuth JWT denylist.
* auth/tpm: Fix broken implementation of alias-lookahead and resolve-role operations.
* auth/tpm: Improve locking during login operations. Return permission denied for login renew with invalid role. Fix inconsistent case handling on login endpoints.
* auth/tpm: Use sealwrap for CAs in storage.
* auth/userpass (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth: fixed panic when suppling integer as a lease_id in renewal.
* aws/auth: Redact EC2 instance metadata values from AWS auth error messages.
* cli/login: Fix handle leak in `vault login -method=tpm` when using a raw tpm device like /dev/tpm0.
* client/ocsp: Adds a grace period to renew the cached entry for OCSP response.
* consumption-billing: Fix OIDC identity token billing units being computed incorrectly across periodic flush cycles. The billing scalar now applies per-token duration adjustment, so the reported scalar and the per-mount attribution breakdown are always consistent.
* consumption-billing: Fix bug where PKI, SSH and SSH OTP certificate billing units from performance standby nodes were not being forwarded to active nodes for storage, causing billing events on standby nodes to be lost.
* consumption-billing: Fix bug where SPIFFE JWT token billing units from performance standby nodes were not being forwarded to active nodes for storage, causing billing events on standby nodes to be lost.
* consumption-billing: Fixed a bug where SSH duration-adjusted certificate counts and OTP counts whose decimal representation began with '4' could not be read back from storage, causing `sys/billing/overview` to return a 500 error with "lz4: bad magic number". The storage encoding now uses plain decimal strings consistent with other billing metrics, avoiding misidentification as lz4-compressed data.
* consumption-billing: Fixed bug where OIDC token duration counts from performance standby nodes were not forwarded to active nodes for storage, causing billing events on standby nodes to be lost.
* consumption-billing: Fixed deadlocks in KMIP and mount-scanning billing paths by avoiding nested lock acquisition during mount and plugin enumeration.
* consumption-billing: Fixes LDAP and OpenLDAP dynamic and static role counting in use-case billing to use dedicated count endpoints (role-count, static-role-count) instead of LIST-based counting, which was undercounting roles.
* consumption-billing: Fixes bug where deserializing newline characters in retrieved counts causes a panic. Now strips leading and trailing whitespace from retrieved counts.
* core (enterprise): fix unaligned atomic panic in replication code on 32-bit platforms.
* core (enterprise): Avoid duplicate seal rewrapping, and ensure that cluster secondaries rewrap after a seal migration.
* core (enterprise): Buffer the POST body on binary paths to allow re-reading on non-logical forwarding attempts. Addresses an issue for SCEP, EST and CMPv2 certificate issuances with slow replication of entities
* core (enterprise): Fix a bug that causes unnecessary seal rewrapping.
* core (enterprise): Fix a data race and potential panic during seal/unseal
* core (enterprise): Fix a data race and potential panic during seal/unseal
* core (enterprise): Fix crash when seal HSM is disconnected
* core (enterprise): Fix panic in `collectOperatorImportMetrics` when `router.Route` returns a nil response with no error during KVv2 metadata reads on performance secondary nodes. This condition occurs during the WAL-stream partial-sync phase of an initial join.
* core (enterprise): Preserve wrapping metadata when Control Group unwrap replays an approved request that returns a wrapped response.
* core (enterprise): Update state checking of Sever-Side Consistent Token (SSCT) when used on performance secondary clusters. 403 response codes will be preferred over 412 for invalid, cross cluster token requests to secondary active nodes.
* core/activitylog (enterprise): Fix a panic in CensusReport ACL policy metrics collection by safely handling transient missing policies and nil policy path/permission data while policies are changing.
* core/activitylog (enterprise): Resolve a stability issue where Vault Enterprise could encounter a panic during month-end billing activity rollover.
* core/identity (enterprise): Fix excessive logging when updating existing aliases
* core/login: Fix panic on malformed login requests. Vault now returns an error for malformed login payloads instead of dropping the client connection (no data loss).
* core/managed-keys (enterprise): Allow slot numbers above 32 bits in PKCS#11 managed keys.
* core/managed-keys (enterprise): Fix a bug that prevented the max_parallel field of PKCS#11 managed keys from being updated.
* core/managed-keys (enterprise): Fix a problem that prevented 'mac' and 'generate_random' key usages from being set.
* core/managed-keys (enterprise): client credentials should not be required when using Azure Managed Identities in managed keys.
* core/metrics: Fixed a bug where log_format = "json" had no effect on telemetry sink errors from statsd and statsite backends.
* core/mounts: Fixed `vault secrets move` (and `vault auth move`) incorrectly placing a mount in the root namespace when the destination path has a leading slash.
* core/rotation: avoid shifting timezones by ignoring cron.SpecSchedule
* core/rotationMgr: Fix storage routing for local mounts in namespaces to prevent metadata replication and ensure GDPR compliance.
* core/seal: Fixed goroutine leak occurring when Encryption and Decryption functions time out.
* core/snapshots: Fix issue during single item snapshot restore operations where snapshot locks were being checked prior to authentication, resulting in some failed requests not being audited.
* core/wrapping: sys/wrapping/wrap now enforces uuid-format wrapping tokens, ignoring any caller-requested wrap format.
* core: Fix `vault operator migrate -start` command when migrating to raft integrated storage.
* core: Fix bug where background thread to clean the MFA response auth queue runs on PR and DR secondaries.
* core: Fix failure to detect errors during storage writes of totp keys.
* core: Preserve URL query parameters when redirecting API requests containing duplicate slashes to their canonical path. Previously, the redirect dropped parameters such as `?list=true`, potentially changing the result of the request.
* core: Standby clusters now populate the `cluster:` field when `sys/metrics` is called.
* core: interpret all new rotation manager rotation_schedules as UTC to avoid inadvertent use of tz-local
* core: vault kv put/get now works with external OAuth tokens.
* cubbyhole: Fix cubbyhole writes for JWT tokens in non-root namespaces
* database/mssql: Fix "sysadmin" requirement during lease revocation by replacing the undocumented `sp_msloginmappings` procedure with a granular metadata query. This allows the plugin to function with `VIEW ANY DEFINITION` instead of full `sysadmin` privileges.
* database/mssql: Fix dynamic secret revocation by executing custom statements as a single batch instead of splitting on semicolons
* database/snowflake: Fix WAL rollback issue for key-pair root credential rotation.
* database: prevent static role rotation and connection init from hanging indefinitely when database calls block by adding timeouts around UpdateUser and Initialize
* default-auth: Fix issue when specifying "root" explicitly in Default Auth UI
* default-auth: Fix issue with legacy default-auth configs that would break as part of upgrading to a newer version of Vault.
* events (enterprise): Fix a bug where events stopped being forwarded to performance secondaries after the active node restarted or had a change event (seal/unseal, etc).
* events (enterprise): Fix missed events when multiple event clients specify the same namespace and event type filters and one client disconnects.
* events (enterprise): Fix panic when replicating lease events.
* export API: Normalize the end_time parameter in the activity export API to the end of the month to match the behavior stated in the documentation.
* go-plugin: Upgrade go-plugin to fix a bug where file descriptors could be leaked when spawning external plugins
* http: skip JSON limit parsing on cluster listener
* identity/entity-alias (enterprise): Reject alias creation when an explicit `mount_accessor` names an OAuth Resource Server profile whose issuer differs from the supplied `issuer`. Such an alias was previously stored without complaint and then bound the issuer it named rather than the profile the accessor pointed at. Aliases already stored with that contradiction keep working and are not revalidated, but re-submitting one to `identity/entity-alias` is now refused; update it through `identity/entity-alias/id/{id}` instead, which is unaffected.
* identity/entity: Fixed an issue where the `from_entity`'s entity aliases were not properly deleted during entity merges.
* identity/scim (enterprise): Fix Group responses so the 2.1 extension schema is returned according to the client's default schema version or explicitly requested schema.
* identity/scim (enterprise): Fix SCIM `meta.location` and `Location` response header returning an internal cluster address instead of the address used by the client. Location URLs are now derived from the incoming request's `Host` header, ensuring correct values when Vault is accessed through a load balancer or reverse proxy such as HVD.
* identity: Fix duplicate member_entity_ids entries in external groups when a JWT/OIDC login token carries repeated group-name entries in the groups claim.
* identity: Fix issue where Vault may consume more memory than intended under heavy authentication load.
* identity: Fixed an issue where merging entities via a Performance Replication secondary cluster left the source entity as a ghost on the primary cluster.
* identity: Fixed entity alias creation failing with "mount accessor namespace does not match request namespace" when using a synthetic mount accessor in a namespaced context
* identity: Normalize group and entity name paths to lowercase before ACL evaluation to prevent deny policy bypass via case variation
* identity: Repair the integrity of duplicate and/or dangling entity aliases.
* identity: fixed a rare but possible data race issue with identities.
* identity: handle creating/updating an alias without external_id or issuer
* jwt/oauth-resource-server: Token capability checks now support OAuth JWTs and return permissions based on the token's allowed access.
* kmip (enterprise): Fix a bug that prevents the legacy CA from working on a named listener.
* kmip (enterprise): Fix a bug that would cause a panic on Create Key Pair operations that specify no attributes for the private or the public key.
* ldap auth (enterprise): Fix root password rotation for Active Directory by implementing UTF-16LE encoding and schema-specific handling. Adds new 'schema' config field (defaults to 'openldap' for backward compatibility).
* logging: Fixed an issue where the `log_requests_level` configuration was not respected on a SIGHUP reload when set to "off" or removed from the config file.
* oauth-resource-server (enterprise): Fix issue where RAR enforcement was skipped when the token's `iss` claim had cosmetic differences (e.g. different casing or trailing slash) compared to the issuer stored in the resource server profile.
* oauth-resource-server (enterprise): Fix issue where `optional_authorization_details` was incorrectly ignored for delegated (OBO) workflows when the subject has no agent registration, resulting in RAR not being mandatory in those requests.
* oauth-resource-server (enterprise): OAuth Resource Server authorization now treats an empty `authorization_details` array like an absent claim when authorization details are optional. Previously, tokens containing an empty array were rejected with `RAR_NO_MATCH` instead of continuing through normal identity and policy authorization.
* oauth-resource-server (enterprise): Fix `vault:path_access` authorization details denying allowed requests with `RAR_NO_MATCH` in non-root namespaces and treating `*` and `+` wildcards as literal characters. Paths are now matched like ACL policy paths in the namespace of the OAuth resource server profile that validated the token, including when the token is used in a child namespace.
* plugins (enterprise): Fix bug where requests to external plugins that modify storage weren't populating the X-Vault-Index response header.
* plugins/database/hana: Fixed a SQL injection risk in the default DeleteUser revoke path by safely quoting usernames as SQL identifiers before ALTER USER and DROP USER statements.
* plugins/database/redshift: Fixed a SQL injection risk in the default DeleteUser revoke path by safely quoting usernames as SQL string literals when invoking terminateloop(...), preventing statement-structure manipulation.
* plugins: Fix issue with `vault plugin reload -mounts` command when run in the root namespace
* plugins: Fix plugin signature verification failure with expired pgp key when registering a plugin.
* plugins: Fix regression in plugin sdk where external plugins may panic when doing storage writes/deletes.
* plugins: Reading a versioned-only plugin without specifying `-version` now auto-selects it when only one version exists, or returns an error listing available versions, instead of a silent 404.
* proxy/cache (enterprise): Fixed a bug in the static secret cache where `GET` requests with `?list=true` were incorrectly cached and served stale.
* quotas: Vault now protects plugins with ResolveRole operations from panicking
on quota creation.
* replication (enterprise): Allow operators to manage automated snapshot configurations on a DR secondary node using a DR operation token.
* replication (enterprise): fix rare panic due to race when enabling a secondary with Consul storage.
* rotation: Fix a bug where a performance secondary would panic if a write was made to a local mount
* sdk/ldaputil: Fix malformed error messages that embedded the literal `{{err}}` placeholder and a `%!(EXTRA ...)` marker, and wrap the underlying error so `errors.Is`/`errors.As` work.
* sdk/rotation: Subsequent calls will no longer allow both the `rotation_period` and `rotation_schedule` fields to be set simultaneously. The SDK now explicitly empties the opposing field to guarantee mutual-exclusion.
* sdk/testcluster: Redact root token value from trace-level log messages in the Docker test cluster helper.
* sdk: Small bugfixes relating to docker test container cleanup and image building.
* secret sync (enterprise): fix panic in set-association API when using Vault Proxy with token-bound CIDRs. The panic occurred due to missing connection information during CIDR validation.
* secret sync (enterprise): fixed panic due to nil pointer dereference when reconciling associations. Added guard checks to prevent access to nil references, making association handling more robust.
* secret-sync (enterprise): Fix GCP Secret Manager replication policy persistence across Vault restarts.
* secret-sync (enterprise): Fix race condition in secretsSetRemoveHandler by serializing MemDB transaction access.
* secret-sync (enterprise): Improved unsync error handling by treating cases where the destination no longer exists as successful.
* secret/pki: Fix ACME order finalize race condition where concurrent requests could double-issue certificates and orphan one from order-keyed tracking
* secret/pki: prevent key rename from accepting a name already held by a different key.
* secrets (pki): Allow issuance of certificates without the server_flag key usage from SCEP, EST and CMPV2 protocols.
* secrets-sync (enterprise): Corrected a bug where the deletion of the latest KV-V2 secret version caused the associated external secret to be deleted entirely. The sync job now implements a version fallback mechanism to find and sync the highest available active version, ensuring continuity and preventing the unintended deletion of the external secret resource.
* secrets-sync (enterprise): Fix `LIST /v1/sys/sync/associations` intermittently returning zero associations/secrets by forwarding the request to the active node instead of allowing it to be served locally by a performance standby or performance secondary.
* secrets-sync (enterprise): Fix destination PATCH handling for WIF identity_token_ttl normalization and GCP service_account_email decoding.
* secrets-sync (enterprise): Fix destinations configured with `allowed_ipv4_addresses` or `allowed_ipv6_addresses` failing with `INTERNAL_VAULT_ERROR` after a leadership change, until the destination configuration was reapplied.
* secrets-sync (enterprise): Fix issue where secrets were not properly un-synced after destination config changes.
* secrets-sync (enterprise): Fix issue where sync store deletion could be attempted when sync is disabled.
* secrets-sync (enterprise):fixed incorrect error response code mapping for GCP Secrets Sync Customer Controlled Encryption validations, which were returned as 500 Internal Server Error instead of 400 Bad Request.
* secrets-sync: Fix GCP Secret Manager destinations losing their per-region KMS key on Vault restart.
* secrets-sync: Fixes Custom Tags field in Details view to display keys with empty value
* secrets-sync: secrets-sync APIs return appropriate client side error codes when the request is invalid.
* secrets/aws: Fix STS HTTP connection reuse after AWS SDK v2 migration
* secrets/azure: Ensure proper installation of the Azure enterprise secrets plugin.
* secrets/database (enterprise): Fix cleanup of database plugin sub processes and resources when initialization of the database connection fails.
* secrets/database/mssql: Deregister stale TLS configurations when MySQL connection TLS settings change or the connection is closed, preventing retained certificate pools from accumulating.
* secrets/database: Fix WAL resume for rsa_private_key static roles; an interrupted rotation would discard the in-flight keypair instead of rolling it forward.
* secrets/database: Fix missing-credentials error for Database types without self-managed support incorrectly suggesting the self-managed option.
* secrets/database: Sanitize the caller-controlled DisplayName before it is used in generated usernames to prevent SQL injection via username templates. Adds a configuration warning when a username_template references DisplayName without a truncate function.
* secrets/kmip (enterprise): Address a nil pointer within the invalidation handler for managed objects.
* secrets/ldap: enable proper license checking on 'openldap' plugin alias. This enables enterprise features when configuring mounts with the 'openldap' alias.
* secrets/ldap (enterprise): Manual static role rotation correctly resets the `TTL` and `next_vault_rotation` timestamp and adjusting its automated rotation cadence accordingly
* secrets/nomad: Fix connection exhaustion under high concurrency by introducing a shared, pooled HTTP client with a per-host connection cap. Previously, a new TCP connection was opened for every credential request, causing Nomad to return HTTP 429 "too many concurrent connections" errors when more than 100 leases were generated simultaneously.
* secrets/pki (enterprise): Address cache invalidation issues with CMPv2 on performance standby nodes.
* secrets/pki (enterprise): Address issues using SCEP on performance standby nodes failing due to configuration invalidation issues along with errors writing to storage
* secrets/pki (enterprise): Fix SCEP nonce logging in audit data.
* secrets/pki (enterprise): Fix SCEP related digest errors when requests contained compound octet strings
* secrets/pki (enterprise): Fix panic in CMPv2 sentinel field parsing when cert request messages is empty.
* secrets/pki (enterprise): Fix unified CRL not being rebuilt after the background transfer copies locally-revoked certificates into unified storage.
* secrets/pki (enterprise): Include root CA in chain for CIEPS endpoints when root is the direct issuer, unless `remove_roots_from_chain` is true.
* secrets/pki (enterprise): Modify the SCEP GetCACaps endpoint to dynamically reflect the configured encryption and digest algorithms.
* secrets/pki: Fix PKI certificate issuance not_after time to respect max TTL.
* secrets/pki: Remove invalid value from the supported list of ACME algorithms.
* secrets/pki: Return error when issuing/signing certs whose NotAfter is before NotBefore or whose validity period isn't contained by the CA's.
* secrets/pki: The root/sign-intermediate endpoint max_path_length parameter is now restricted by the signing CA's max_path_length if set.
* secrets/pki: The root/sign-intermediate endpoint should not fail when provided a CSR with a basic constraint extension containing isCa set to true
* secrets/pki: Warn if the Country field on roles and when generating CAs is not ISO 3166 compliant
* secrets/pki: allow glob-style DNS names in alt_names.
* secrets/transit (enterprise): Add managed key support to CSR sign and set certificate chain endpoints.
* secrets/transit (enterprise): Address panic when using Azure managed keys for encrypt and decrypt operations.
* secrets/transit (enterprise): Fix bugs that prevent using ML-DSA and SLH-DSA keys after reading the policy from storage.
* secrets/transit: Add managed key support to Transit rewrap endpoint.
* secrets/transit: Fix nil pointer panic when restoring malformed backup data.
* secrets/transit: fix CSR re-signing to preserve extension Critical flags and prevent malformed ASN.1 output when Subject Alternative Names and extra extensions are both present
* serviceregistration/consul: Fixed an issue where Vault would permanently deregister itself from the Consul service catalog when a SIGHUP/reload signal was sent and the configuration used Consul as the storage backend without an explicit `service_registration` stanza.
* storage/raft: reject `performance_multiplier` values less than or equal to zero
* tpm cli: Fix errors when using an explicit -tpm-device-path that's not a socket with `vault tpm` and `vault login -method=tpm` commands.
* ui (enterprise): Fix KV v2 not displaying secrets in namespaces.
* ui (enterprise): Fix Secrets Sync landing page instructions that incorrectly limited supported secrets engines to KV v2
* ui (enterprise): Fixes login form so input renders correctly when token is a preferred login method for a namespace.
* ui (enterprise): fix dashboard hang on initial load due to nil storage in checklistStateManager
* ui/pki: Fixes certificate parsing of the `key_usage` extension so details accurately reflect certificate values.
* ui/pki: Fixes creating and updating a role so `basic_constraints_valid_for_non_ca` is correctly set.
* ui/secrets/pki: Fix issuers list page failing to load when issuer count exceeds 10
* ui/transit: Fix key version dropdown selected state when editing a transit key.
* ui: Add name field validation to LDAP create and edit roles forms.
* ui: Correctly handle string values ("true"/"false") for `tls_disable` when displaying TLS status in the Cluster Configuration widget.
* ui: Fix 403 error on auth method Configure page for policies that grant read on sys/auth* but not sys/auth/*.
* ui: Fix DR operation token generation failing with a 403 error by sending the primary root token as the X-Vault-Token header.
* ui: Fix KV v2 metadata list request failing for policies without a trailing slash in the path.
* ui: Fix Kubernetes auth method not saving `token_reviewer_jwt` — the wrong OpenAPI schema key (`KubernetesConfigureRequest`) was used instead of `KubernetesConfigureAuthRequest`, causing the JWT field to be omitted from the form and API payload on save.
* ui: Fix LDAP hierarchical role navigation in UI
* ui: Fix agent registry ceiling policies not displaying due to incorrect property name
* ui: Fix border clipping on dashboard widget tables by applying overflow-hidden styling.
* ui: Fix entities page to show success message after successfully editing an entity.
* ui: Fix open redirect bug in OIDC provider route.
* ui: Fix policy creation automation snippets not updating when switching from visual editor to code editor
* ui: Fix policy generator flyout rejecting saves when no capabilities are selected for a rule.
* ui: Fix regression where the client count billing configuration request omitted the root-namespace header, causing 404s on Monitoring > Client Count when viewed from a child namespace
* ui: Fix secrets table pagination when switching page sizes.
* ui: Fix secrets to secrets-engines redirect for bookmarked URLs.
* ui: Fix the self-managed LDAP static role details page showing a blank password after manually rotating credentials.
* ui: Fix total secrets count binding on secrets sync overview page to match the API response key.
* ui: Fixed an issue where enabling a KV secrets engine from a performance standby or performance secondary displayed an error even though the mount was created successfully. The UI now waits for the request to be forwarded and the mount to become available before loading the new engine.
* ui: Fixed analytics identity persisting across logout by calling reset on the Segment provider.
* ui: Fixed custom messages list to display the expiration time on Inactive message badges.
* ui: Fixed edit policy code block to sync with user policy input.
* ui: Fixed sidebar navigation animation issues
* ui: Fixes PKI generate root so Not valid after correctly controls cert expiration inputs.
* ui: Fixes login form so `?with=<path>` query param correctly displays only the specified mount when multiple mounts of the same auth type are configured with `listing_visibility="unauth"`
* ui: Hide the Manage menu on LDAP role and library details pages when the token has no permitted actions, and show Rotate credentials only when the token can update the rotate-role path.
* ui: Purge Segment localStorage keys when analytics consent is declined so tracked data is never retained after a user opts out
* ui: Report enterprise plan name from version service instead of inferring from licenseId
* ui: Resolve the flickering on the login page when a trailing slash is added to the namespace in the field.
* ui: Resolved a regression that prevented users with create and update permissions on KV v1 secrets from opening the edit view. The UI now correctly recognizes these capabilities and allows editing without requiring full read access.
* ui: Restore re-sizable columns for secrets and namespaces tables.
* ui: Reverts Kubernetes CA Certificate auth method configuration form field type to file selector
* ui: Update DR operation token generation to accept a primary root token for authentication.
* ui: Update KV max_version validation to disallow negative values.
* ui: Update LDAP accounts checked-in table to display hierarchical LDAP libraries
* ui: Update LDAP library count to reflect the total number of nodes instead of number of directories
* ui: Warn on the LDAP Create role page when the token can't read the engine configuration, hide Create role when the token can't create roles, and keep the stored password when it's left empty on the Edit role page.
* ui: add totalItems property to fix filtered list pagination showing incorrect total page count
* ui: fix renew token button rendering for denied renew-self.
* ui: fix spurious "No access" banner when navigating to Vault UI with `?namespace=root` in the URL
* ui: prevent creating a policy with a whitespace-only name and trim leading/trailing whitespace from policy names.
* ui: remove unnecessary 'credential type' form input when generating AWS secrets
## 2.1.2
### October 07, 2026
BREAKING CHANGES:
* pki: ACME finalization with the default `sign-verbatim` directory policy now rejects CSRs that contain URI SANs, email SANs, or Other SANs. ACME challenges only verify DNS names and IP addresses; those SAN types are never validated and must not appear in issued certificates. Operators who require the previous behaviour can set `default_directory_policy = "sign-verbatim-unsafe"` in `config/acme`, accepting that the resulting certificates may contain unverified identity claims.
SECURITY:
* core (enterprise): Prevent policy-name canonicalization bypasses in ACL parameter restrictions.
* core/plugin: Fix plugin catalog entries restored from a raft snapshot, written through `sys/raw`, or replicated being able to run a binary outside `plugin_directory`.
* core/policy: Harden request-time ACL construction to ignore malformed legacy policy references containing path-navigation segments (`.` or `..`) so traversal-style names are never resolved or applied.
* core: Fixed a bypass of exact-deny ACL policies where case-variant AppRole, AWS, Azure, GCP, Kubernetes, SCEP, or TPM role names, GitHub team or user policy mapping keys, certificate or CRL names, ACL/RGP/EGP policy names, or userpass usernames could evade the deny and be resolved by the backend to the same protected resource. Okta group names, LDAP and RADIUS names on mounts left in their default case-insensitive configuration, and Enterprise SCIM client names (`identity/scim/client/<name>`, where a case-variant write overwrites the existing client) are not covered by this fix and remain subject to the same bypass; avoid combining a wildcard allow with an exact deny on those mounts and paths.
CHANGES:
* core/plugin: Plugin catalog entries are now checked against `plugin_directory` whenever they are used, not only at registration. An entry whose command resolves outside the directory, including through a symlink, is refused with `plugin command is outside of configured plugin directory`, and mounts that use it are skipped at startup while keeping their data. Such plugins must be registered again with their binary inside `plugin_directory`.
* core/policy: Vault now validates policy names with segment-aware checks. Empty names and names containing `.` or `..` path segments are rejected for new policy writes and assignments, while names containing `/` and `\` remain supported. During request-time ACL construction, legacy traversal-style policy references are not applied (treated as invalid and unresolved), which can reduce effective token permissions. Operators should audit and rename affected policies before upgrading.
* core: ACL and Sentinel EGP rule paths targeting a specific AppRole, AWS, Azure, GCP, Kubernetes, SCEP, or TPM role, GitHub team or user policy mapping key, certificate or CRL name, ACL/RGP/EGP policy name, or userpass username are now matched against the lowercased resource name, since these backends resolve those names case-insensitively. A rule written with a mixed-case resource name (for example `auth/approle/role/MyRole`) no longer matches requests for that resource and must be rewritten using the lowercase name (`auth/approle/role/myrole`). The lowercased form is also what Sentinel RGP and EGP policies observe as `request.path`, so policy rules that compare that value against a mixed-case path (for example `request.path is "auth/approle/role/MyRole"`) must be updated as well. External auth and secret plugins are not affected by this normalization and continue to receive requests with their original casing. Existing deny rules using mixed-case resource names will fail open (become allow-all) after upgrade until rewritten with lowercase names.
IMPROVEMENTS:
* auth/spiffe (enterprise): Add SPIFFE login cli handler.
* secrets/pki: Add `extra_subject_names_oids` field to roles to allow specifying additional OID subject name components.
BUG FIXES:
* auth/approle: Fix `token_bound_cidrs` validation when using /128 blocks for role and secret ID
* ui: Fix regression where the client count billing configuration request omitted the root-namespace header, causing 404s on Monitoring > Client Count when viewed from a child namespace
## 2.1.1
### September 16, 2026
SECURITY:
* core: Update github.com/apache/thrift to v0.24.0 to fix security vulnerability ghsa-8wv5-x4w7-5gww.
* core: Update golang.org/x/crypto to v0.56.0 to fix security vulnerabilities GO-2026-6354 and GO-2026-6355.
* core: Update google.golang.org/grpc to v1.83.2 to fix security vulnerability GHSA-2v4p-qf9q-27wj.
CHANGES:
* auth/jwt: Added Okta provider with group fetching from Admin API when fetch_groups=true and truncation is detected.
* auth/jwt: Update plugin to [v0.26.4](https://github.com/hashicorp/vault-plugin-auth-jwt/releases/tag/v0.26.4)
* core/raft: Limited concurrent retry-join workers to 20. Any further retry-join attempts while 20 are in progress will result in an error (`too many concurrent raft retry joins in progress`).
* core: Bump Go version to 1.26.8
IMPROVEMENTS:
* secrets import: Add `allowed_ipv4_cidrs` to `source_aws` and `source_azure` Secrets Import blocks to allow private CIDR exemptions for SSRF-safe connectivity.
* secrets/pki: add an additional field to include an RFC 5280 revocation reason for (/pki/revoke) and (/pki/revoke-with-key).
* ui: Bump dompurify to 3.4.15 to address SECVULN advisories
BUG FIXES:
* Secrets Recovery (enterprise): Fixing Vault panic in cli when running `vault recover` without a path.
* auth/jwt: Fixed incorrect HTTP status codes returned during agent ceiling policy evaluation.
* auth/token: Fixed a bug where `auth/token/lookup` and `auth/token/lookup-self` returned 403 for JWT tokens in a non-root namespace.
* consumption-billing: Fix OIDC identity token billing units being computed incorrectly across periodic flush cycles. The billing scalar now applies per-token duration adjustment, so the reported scalar and the per-mount attribution breakdown are always consistent.
* core/activitylog (enterprise): Fix a panic in CensusReport ACL policy metrics collection by safely handling transient missing policies and nil policy path/permission data while policies are changing.
* core/mounts: Fixed `vault secrets move` (and `vault auth move`) incorrectly placing a mount in the root namespace when the destination path has a leading slash.
* oauth-resource-server (enterprise): Fix issue where RAR enforcement was skipped when the token's `iss` claim had cosmetic differences (e.g. different casing or trailing slash) compared to the issuer stored in the resource server profile.
* plugins: Fix issue with `vault plugin reload -mounts` command when run in the root namespace
* secrets-sync (enterprise): Fix `LIST /v1/sys/sync/associations` intermittently returning zero associations/secrets by forwarding the request to the active node instead of allowing it to be served locally by a performance standby or performance secondary.
* secrets/pki (enterprise): Fix panic in CMPv2 sentinel field parsing when cert request messages are empty.
* secrets/pki (enterprise): Fix unified CRL not being rebuilt after the background transfer copies locally-revoked certificates into unified storage.
* ui: Fix agent registry ceiling policies not displaying due to incorrect property name
* ui: Fix total secrets count binding on secrets sync overview page to match the API response key.
* ui: Resolve the flickering on the login page when a trailing slash is added to the namespace in the field.
## 2.1.0
### September 01, 2026
SECURITY:
* core: Update go.etcd.io/etcd/client/pkg/v3 to v3.7.1 to fix security vulnerability GO-2026-6107.
* core: Update software.sslmate.com/src/go-pkcs12 to v0.7.2 to fix security vulnerability GO-2026-5052.
CHANGES:
* License: Add Agentic IAM terms to client licensing model and update terms for Vault Platform licensing model.
* core: Bump Go version to 1.26.7.
* oauth-resource-server (enterprise): Prevent issuer_id from being mutated after OAuth Resource Server profile creation. Operators must delete and recreate profiles to change the issuer_id.
* oauth-resource-server (enterprise): Prevent unique_id_claim from being mutated after OAuth Resource Server profile creation. Operators must delete and recreate profiles to change the unique_id_claim.
* oauth-resource-server (enterprise): The OAuth Resource Server feature no longer requires activation via the `sys/activation-flags/oauth-resource-server/activate` endpoint.
* oauth-resource-server (enterprise): Update OAuth Resource Server config to include custom claim options for the token's unique identifier and actor.
* secrets/openldap (enterprise): Update plugin to [v0.18.4+ent](https://github.com/hashicorp/vault-plugin-secrets-openldap/releases/tag/v0.18.4+ent)
FEATURES:
* **Agent Registry UI (enterprise)**: Adds a new Agentic Security section to the primary navigation with an Agent Registry page where operators can view, search, and manage registered AI agents, their associated Vault entities and aliases, assigned policies, and operational status.
* **Automatic DNS-01 Challenge Fulfillment for PKI External CA**: Integrate with the following DNS providers for automatic DNS-01 challenge fulfillment: AWS Route53, Azure DNS, Google Cloud DNS, and BIND and other RFC2136-compliant servers.
* **PKI PKCS#12 and JKS Support**: Adds support for PKCS#12 (PFX) and Java keytool (JKS) certificate bundles to relevant PKI endpoints. Bundles are returned as base64-encoded, password-protected files.
* **SLH-DSA support for Hybrid sign/verify in Transit engine (enterprise)**: Add support for SLH-DSA as the PQC component for Hybrid sign/verify operations. This is compatible with both ECDSA (p-256, P-384, P-521) and Ed25519.
* secrets/pki-external-ca (enterprise): Add support for handling dns-01 challenges for Azure, AWS, GCP, and rfc2136 DNS.
IMPROVEMENTS:
* agent-registry (enterprise): Removed the restriction that disallowed the use of 'deny' in ceiling policies, resulting in request errors.
* agent/pkiexternalca: Replace go.uber.org/atomic with sync/atomic (stdlib) for atomic boolean operations in the pkiexternalca package.
* auth/token: Add global denylist for revoking OAuth JWTs to prevent authorization of specific tokens across all namespaces.
* core/seal (enterprise): Update Oracle Cloud library to enable seal integration with newer regions.
* ui: Bump `dompurify` from `3.4.6` to `3.4.13`.
* ui: Bump shell-quote from 1.8.4 to 1.9.0.
* ui: Exposing the RSA Private Key field in the UI when generating credentials with the snowflake database secrets engine. Previously, this field was only shown in the cli.
* ui: Secrets engine delete confirmation modal now requires typing `delete-engine` to confirm, displays the engine name, secret count (KV engines only), and a list of what will be permanently deleted. ConfirmModal has now been updated to include a optional type-to-confirm.
BUG FIXES:
* agent/pki-external-ca: Fix CA chain extraction from Vault PKI API responses where `ca_chain` field was always empty in templates due to incorrect type handling of array responses
* api: Account for the HTTP Age header when calculating a lease's remaining lifetime, so that leases read or renewed through a caching proxy such as Vault Agent are renewed before they expire.
* core (enterprise): Fix a data race and potential panic during seal/unseal
* core (enterprise): Fix a data race and potential panic during seal/unseal
* core (enterprise): Fix panic in `collectOperatorImportMetrics` when `router.Route` returns a nil response with no error during KVv2 metadata reads on performance secondary nodes. This condition occurs during the WAL-stream partial-sync phase of an initial join.
* core/login: Fix panic on malformed login requests. Vault now returns an error for malformed login payloads instead of dropping the client connection (no data loss).
* core/metrics: Fixed a bug where log_format = "json" had no effect on telemetry sink errors from statsd and statsite backends.
* core/wrapping: sys/wrapping/wrap now enforces uuid-format wrapping tokens, ignoring any caller-requested wrap format.
* core: Fix `vault operator migrate -start` command when migrating to raft integrated storage.
* core: vault kv put/get now works with external OAuth tokens.
* cubbyhole: Fix cubbyhole writes for JWT tokens in non-root namespaces
* default-auth: Fix issue with legacy default-auth configs that would break as part of upgrading to a newer version of Vault.
* identity: Fixed entity alias creation failing with "mount accessor namespace does not match request namespace" when using a synthetic mount accessor in a namespaced context
* oauth-resource-server (enterprise): Fix issue where `optional_authorization_details` was incorrectly ignored for delegated (OBO) workflows when the subject has no agent registration, resulting in RAR not being mandatory in those requests.
* plugins: Reading a versioned-only plugin without specifying `-version` now auto-selects it when only one version exists, or returns an error listing available versions, instead of a silent 404.
* proxy/cache (enterprise): Fixed a bug in the static secret cache where `GET` requests with `?list=true` were incorrectly cached and served stale.
* sdk/rotation: Subsequent calls will no longer allow both the `rotation_period` and `rotation_schedule` fields to be set simultaneously. The SDK now explicitly empties the opposing field to guarantee mutual-exclusion.
* secret/pki: Fix ACME order finalize race condition where concurrent requests could double-issue certificates and orphan one from order-keyed tracking
* secret/pki: prevent key rename from accepting a name already held by a different key.
* secrets/database: Sanitize the caller-controlled DisplayName before it is used in generated usernames to prevent SQL injection via username templates. Adds a configuration warning when a username_template references DisplayName without a truncate function.
* secrets/ldap: manually rotating a static role password will restart the rotation TTL once again, matching the behavior prior to v2.0.0
* secrets/nomad: Fix connection exhaustion under high concurrency by introducing a shared, pooled HTTP client with a per-host connection cap. Previously, a new TCP connection was opened for every credential request, causing Nomad to return HTTP 429 "too many concurrent connections" errors when more than 100 leases were generated simultaneously.
* serviceregistration/consul: Fixed an issue where Vault would permanently deregister itself from the Consul service catalog when a SIGHUP/reload signal was sent and the configuration used Consul as the storage backend without an explicit `service_registration` stanza.
* ui/secrets/pki: Fix issuers list page failing to load when issuer count exceeds 10
* ui: Fix 403 error on auth method Configure page for policies that grant read on sys/auth* but not sys/auth/*.
* ui: Fix Kubernetes auth method not saving `token_reviewer_jwt` — the wrong OpenAPI schema key (`KubernetesConfigureRequest`) was used instead of `KubernetesConfigureAuthRequest`, causing the JWT field to be omitted from the form and API payload on save.
* ui: Fix border clipping on dashboard widget tables by applying overflow-hidden styling.
* ui: Fix open redirect bug in OIDC provider route.
* ui: Fix policy generator flyout rejecting saves when no capabilities are selected for a rule.
* ui: add totalItems property to fix filtered list pagination showing incorrect total page count
* ui: fix spurious "No access" banner when navigating to Vault UI with `?namespace=root` in the URL
## 2.0.4
### August 04, 2026
BREAKING CHANGES:
* containers: The following packages have been removed from UBI based container
images: gnupg, openssl, procps.
SECURITY:
* acl: Fix privilege-escalation vulnerability where a `denied_parameters` constraint on the `policies` request field could be bypassed by submitting a mixed-case policy name (e.g. "Super-Admin" instead of "super-admin"). Vault now normalizes the `policies` parameter to lowercase before evaluating `allowed_parameters`/`denied_parameters` constraints.
* identity/scim (enterprise): The `identity/entity/merge` endpoint now rejects requests that involve any SCIM-managed entity, preventing privileged operators from bypassing SCIM ownership guardrails to transfer aliases, group memberships, or policies across SCIM boundaries.
* identity: Prevent the entity batch-delete endpoint (identity/entity/batch-delete) from deleting the underlying storage of entities that belong to another namespace.
* identity: entity/name updates now reject mismatched id or external_id selectors to prevent retargeting updates to a different entity
CHANGES:
* auth/oci: Update plugin to [v0.21.3](https://github.com/hashicorp/vault-plugin-auth-oci/releases/tag/v0.21.3)
* core: Bump Go version to 1.26.5.
* core: remove support for duplicate attributes in HCL configuration files and policy definitions. Parsing HCL with
duplicate attributes now always fails, and the VAULT_ALLOW_PENDING_REMOVAL_DUPLICATE_HCL_ATTRIBUTES environment
variable that previously restored the legacy behavior has been removed.
FEATURES:
* secrets: Added ability to view secrets in YAML format
IMPROVEMENTS:
* auth/cert: Support login via x-forwarded cert headers even with tls disabled on the vault listener.
* core (enterprise): Add an endpoint at `sys/config/oauth-resource-server/id/:config_id` to read oauth resource server profiles by `config_id`
* core (enterprise): Make OAuth resource server JWT `typ` validation more permissive for tokens from IdPs such as Okta by allowing a missing `typ` header, while restricting present `typ` values to `at+jwt`, `application/at+jwt`, and `JWT`.
* core (entreprise): Ameriolate sealwrap lock contention for core paths.
* core/acl: Adds a global `deny_slash_in_templated_path` configuration option to reject the presence of slashes in rendered identity templates in policies, defaulting to `false`.
* core/identity: Adds a global `deny_slash_in_templated_path` configuration option to reject the presence of slashes in rendered identity templates in policies, defaulting to `false`.
* core/managed-keys/PKCS#11 (enterprise): Providing a non-empty value for one field while the other is already saved is rejected. To switch addressing modes, you must explicitly clear the old field by sending it as an empty string ("") in the same request alongside the new value.
* core/managed-keys/PKCS#11 (enterprise): slot and token_label are now strictly enforced as mutually exclusive identifiers for an HSM token
* events: Add `VAULT_EVENT_NOTIFICATIONS_BOUNDED_QUEUE_SIZE` environment variable to configure bounded event queues for event notification subscribers. Set to a positive integer (e.g., 16) to enable buffered channels of that size (maximum 1000). This prevents resource exhaustion in deployments with high subscriber counts, but comes at the cost of the potential for subscribers to miss events. Defaults to 0 (unbuffered) for backward compatibility.
* identity/scim (enterprise): Added filtering support to the `GET /scim/v2/Users` and `GET /scim/v2/Groups` endpoints per RFC 7644. Supported filters: `userName eq`, `externalId eq`, `active eq`, and `meta.lastModified gt/ge/lt/le` for Users; `displayName eq` and `meta.lastModified gt/ge/lt/le` for Groups. Unsupported filter expressions return HTTP 400. `ServiceProviderConfig` now advertises `filter.supported: true`.
* identity/scim (enterprise): Improve SCIM User and Group listing endpoint performance by using prefix sort instead of a separate sort pass.
* identity: Include entity status and entity/alias timestamp details in entity list key_info responses.
* oauth-resource-server: Add support for fine-grained policy control options (parameter constraints) in Rich Authorization Requests (RAR), including `allowed_parameters`, `denied_parameters`, and `required_parameters` inside `authorization_details`.
* oauth-resource-server: Add support for identity template expressions (e.g. `{{identity.entity.id}}`) in Rich Authorization Requests (RAR).
* scim: User resources now include a read-only `groups` field listing the direct group memberships managed by the requesting SCIM client, per RFC 7643.
* secrets/kv (enterprise): Support reading and recovering KVv2 secrets from a loaded snapshot, including in-place recover and copy-from-path within the same mount and namespace.
* ui: Add a read-only YAML view option to the KV v2 secret details page, alongside the existing UI and JSON views.
* ui: Bump pnpm.overrides entry for `tmp` from 0.2.6 to 0.2.7.
* ui: Bump pnpm.overrides entry for `ws` from 8.20.1 to 8.21.0.
BUG FIXES:
* Proxy/Agent: Fixed a bug where auth method headers accumulated on the shared API client across re-auth cycles.
* Proxy: Fixed a bug where the Vault token header accumulated duplicate values across WebSocket reconnects in the static secret cache updater.
* Secrets Recovery (enterprise): Do not redirect to the active node for list requests to `sys/storage/raft/snapshot-load` or read/delete requests to `sys/storage/raft/snapshot-load/{id}`. If possible, handle these requests on the performance standby, otherwise forward the requests to the active node.
* audit: Fix a regression from CVE-2025-6000 that broke enabling audit devices on Windows when a plugin directory was configured.
* audit: make file and socket audit sink serialization context-aware so canceled or expired requests stop waiting behind blocked audit writes, reducing buildup of goroutines, memory, connections, and file descriptors during audit sink contention
* auth/cert: Add support for x-forwarded cert headers coming from AWS ALBs.
* auth/spiffe (enterprise): Use the full peer certificate chain when verifying certificates.
* aws/auth: Redact EC2 instance metadata values from AWS auth error messages.
* consumption-billing: Fix bug where PKI, SSH and SSH OTP certificate billing units from performance standby nodes were not being forwarded to active nodes for storage, causing billing events on standby nodes to be lost.
* consumption-billing: Fix bug where SPIFFE JWT token billing units from performance standby nodes were not being forwarded to active nodes for storage, causing billing events on standby nodes to be lost.
* consumption-billing: Fixed a bug where SSH duration-adjusted certificate counts and OTP counts whose decimal representation began with '4' could not be read back from storage, causing `sys/billing/overview` to return a 500 error with "lz4: bad magic number". The storage encoding now uses plain decimal strings consistent with other billing metrics, avoiding misidentification as lz4-compressed data.
* consumption-billing: Fixed bug where OIDC token duration counts from performance standby nodes were not forwarded to active nodes for storage, causing billing events on standby nodes to be lost.
* consumption-billing: Fixed deadlocks in KMIP and mount-scanning billing paths by avoiding nested lock acquisition during mount and plugin enumeration.
* consumption-billing: Fixes LDAP and OpenLDAP dynamic and static role counting in use-case billing
to use dedicated count endpoints (role-count, static-role-count) instead of LIST-based counting, which was undercounting roles.
* core (enterprise): Fix a bug that causes unnecessary seal rewrapping.
* core (enterprise): Preserve wrapping metadata when Control Group unwrap replays an approved request that returns a wrapped response.
* core (enterprise): Update state checking of Sever-Side Consistent Token (SSCT) when used on performance secondary clusters. 403 response codes will be preferred over 412 for invalid, cross cluster token requests to secondary active nodes.
* core/managed-keys (enterprise): Allow slot numbers above 32 bits in PKCS#11 managed keys.
* core/seal: Fixed goroutine leak occurring when Encryption and Decryption functions time out.
* core: Preserve URL query parameters when redirecting API requests containing duplicate slashes to their canonical path.
Previously, the redirect dropped parameters such as `?list=true`, potentially changing the result of the request.
* events (enterprise): Fix a bug where events stopped being forwarded to performance secondaries after the active node restarted or had a change event (seal/unseal, etc).
* export API: Normalize the end_time parameter in the activity export API to the end of the month to match the behavior stated in the documentation.
* oauth-resource-server (enterprise): OAuth Resource Server authorization now treats an empty `authorization_details` array like an absent claim when authorization details are optional. Previously, tokens containing an empty array were rejected with `RAR_NO_MATCH` instead of continuing through normal identity and policy authorization.
* secrets-sync (enterprise):fixed incorrect error response code mapping for GCP Secrets Sync Customer Controlled Encryption validations, which were returned as 500 Internal Server Error instead of 400 Bad Request.
* secrets-sync: Fix GCP Secret Manager destinations losing their per-region KMS key on Vault restart.
* secrets-sync: Fixes Custom Tags field in Details view to display keys with empty value
* secrets/pki-external-ca (enterprise): Include the private key within the certificate API response field's PEMs when certificate_format is set to pem_bundle
* secrets/transit (enterprise): Add managed key support to CSR sign and set certificate chain endpoints.
* ui: Correctly handle string values ("true"/"false") for `tls_disable` when displaying TLS status in the Cluster Configuration widget.
* ui: Fixes PKI generate root so Not valid after correctly controls cert expiration inputs.
## 2.0.3
### June 17, 2026
SECURITY:
* auth/radius: Added case_insensitive_names toggle to prevent username collisions and enable case-insensitive user handling.
* core/acl: Fix LIST ACL bypass where a trailing-slash request could skip a more-specific deny rule.
* core: Use constant-time recovery token comparison
* secrets/spiffe (enterprise): Ensure template values are properly escaped.
* transform (enterprise): Add appropriate db specific quoting and escaping.
CHANGES:
* auth/cf: Update plugin to [v0.23.1](https://github.com/hashicorp/vault-plugin-auth-cf/releases/tag/v0.23.1)
* core/acl: LIST requests with a trailing slash now correctly respect more-specific deny policies. Previously, a deny on `path "kv/*" { deny }` could be bypassed for `LIST kv/private/` if a broader allow `path "kv/*"` also existed. Policies relying on the previous (incorrect) behavior may now be denied.
* core: Vault will now redirect non-canonicalized paths (containing `/./`, `/../`, or `//`) to a cleaned path, instead of rejecting these requests
FEATURES:
* **AI Agent Support (Beta/Enterprise)**: Adds beta support for first-class AI agents. Adds
an Agent Registry to register agents, and adds support for using Vault as an OAuth resource server
for registered agent entities. When configured, allows OAuth 2.0 JWTs to be used to directly authorize
requests to Vault, without needing a Vault token.
IMPROVEMENTS:
* secrets/azure: For dynamic apps, Vault now creates the app and its client secret with a single MS Graph API request, significantly reducing temporary errors caused by Azure eventual consistency
* consumption-billing: Add a new `sys/billing/config` endpoint to allow configuration of billing data retention (min 13 months, max 6 years).
* core (Enterprise): Make deadlock detection in sealwrap configurable by adding "sealwrap" to existing configuration detect_deadlocks.
* identity/scim (enterprise): Update PATCH operations on scim/v2/Users to allow multiple modifications in the same patch call, support for patch operations on user metadata and name in addition to active status, and allow specifying `path` value in patch operations
* sdk/helper/keysutil: The lock manager's GetPolicy function now always returns a locked Policy, even when caching is
enabled. The PolicyRequest struct has a new field to indicate whether the caller requires a write lock on the policy.
* ui (enterprise): Migrate charts from Lineal to Carbon Charts in the Client usage overview and Vault usage dashboard.
BUG FIXES:
* core/rotationMgr: Fix storage routing for local mounts in namespaces to prevent metadata replication and ensure GDPR compliance.
* kmip (enterprise): Fix a bug that prevents the legacy CA from working on a named listener.
* secret-sync (enterprise): Fix GCP Secret Manager replication policy persistence across Vault restarts.
* secrets/database/mssql: Deregister stale TLS configurations when MySQL connection TLS settings change or the connection is closed, preventing retained certificate pools from accumulating.
* secrets/pki: Fix PKI certificate issuance not_after time to respect max TTL.
* secrets/transit: Add managed key support to Transit rewrap endpoint.
* storage/raft: reject `performance_multiplier` values less than or equal to zero
## 2.0.2
### June 05, 2026
BREAKING CHANGES:
* containers: Remove `cap_ipc_lock` capability on `vault` at build time to allow running Vault in common container runtimes. Vault in containers will no longer be able to call `mlock()` to lock memory. Operators should set `disable_mlock = true` in Vault's configuration. Runtime operators are advised to disable swapping to guarantee data safety.
* secrets/ssh: RSA key sizes are now limited to a maximum size of 8192 bits addressing CVE-2026-39829
CHANGES:
* core: Bump Go version to 1.26.4
* secrets/azure (enterprise): Update plugin to [v0.26.4+ent](https://github.com/hashicorp/vault-plugin-secrets-azure-enterprise/releases/tag/v0.26.4+ent)
BUG FIXES:
* plugins: Fix plugin signature verification failure with expired pgp key when registering a plugin.
* ui/transit: Fix key version dropdown selected state when editing a transit key.
## 2.0.1
### May 19, 2026
BREAKING CHANGES:
* containers: set cap_ipc_lock capability on vault at build time. Container runtimes will need to add `IPC_LOCK` capabilities when running the vault container.
SECURITY:
* api: Update golang.org/x/net to resolve GO-2026-4918"
* core/identity: reject wildcards in rendered identity templates
* core: Resolve GHSA-j88v-2chj-qfwx by removing our dependency on github.com/jackc/pgx/v3 and github.com/jackc/pgx/v4
* core: Update github.com/Azure/go-ntlmssp to fix security vulnerability v0.1.1.
* core: Update github.com/apache/thrift to fix security vulnerability GHSA-wf45-q9ch-q8gh
* core: Update github.com/jackc/pgx/v5 to fix security vulnerability GHSA-j88v-2chj-qfwx.
* core: Update golang.org/x/net to resolve GO-2026-4918"
* core: Validate both `path` and `file_path` cannot be empty for requests to `sys/audit/{path}`
* sdk: Resolve GHSA-j88v-2chj-qfwx by removing our dependency on github.com/jackc/pgx/v3 and github.com/jackc/pgx/v4
* sdk: Update github.com/Azure/go-ntlmssp to fix security vulnerability v0.1.1.
* sdk: Update github.com/jackc/pgx/v5 to fix security vulnerability GHSA-j88v-2chj-qfwx.
* sdk: Update golang.org/x/net to resolve GO-2026-4918"
CHANGES:
* auth/jwt: Update plugin to [v0.26.3](https://github.com/hashicorp/vault-plugin-auth-jwt/releases/tag/v0.26.3)
* core: Bump Go version to 1.26.3
* identity: Require `sudo` capability to invoke the identity entity merge API endpoint (`identity/entity/merge`).
* secrets/azure: Update plugin to [v0.26.2+ent](https://github.com/hashicorp/vault-plugin-secrets-azure-enterprise/releases/tag/v0.26.2+ent)
* secrets/openldap: Update plugin to [v0.18.1+ent](https://github.com/hashicorp/vault-plugin-secrets-openldap-enterprise/releases/tag/v0.18.1+ent)
FEATURES:
* **Billing metrics dashboard**: Create a new billing dashboard with responsive layout to display metric data.
* **Secrets Sync UI**: Added Workload Identity Federation (WIF) support in the UI for AWS, Azure, and GCP sync destinations
IMPROVEMENTS:
* api: Add `start_month` and `end_month` parameters to `/sys/billing/overview` endpoint to allow querying billing data for specific time ranges.
* api: Add migration_done_at_epoch to sys/seal-status response.
* consumption-billing: Add billing tracking for OS Local Account static roles to support consumption-based billing metrics and high-water mark (HWM) tracking.
* consumption-billing: Added consumption billing metrics for OIDC tokens.
* consumption-billing: Added consumption billing metrics for PKI External CA certificates.
* consumption-billing: Added consumption billing metrics for SPIFFE JWT tokens.
* consumption-billing: Enabled `sys/billing/overview` endpoint in admin namespace.
* consumption-billing: Float64 values returned by `sys/billing/overview` are now rounded to 4 decimal places.
* consumption-billing: Increased billing data retention from 2 months to 37 months. The `/sys/internal/billing/overview` API endpoint now returns 37 months of historical consumption billing data by default.
* consumption-billing: The `/sys/internal/billing/overview` API endpoint now always returns all metric types in the response, even when their values are zero. This ensures consistent response structure for easier client-side parsing.
* core (Enterprise): Sanitized config now shows kms_library config.
* core/seal (enterprise): Make it possible for new nodes to join a cluster configured with Seal High Availability.
* scim: The SCIM Group PATCH handler now supports the path field in the form members[value eq "id"] on remove operations.
* sdk: Expand support for docker test cluster options like seals, kms libraries, and entropy augmentation. DockerClusterNode.UpdateConfig now takes a full set of cluster options instead of just node config.
* sdk: add WIF and rotation helpers for checking if params were updated to allow
the consumer to know when changes need to be persisted to storage
* secrets/pki (enterprise): Allow SCEP to use an issuer that is backed by an RSA based PKCS#11 managed key
* secrets/transit: Change to using Trail of Bits libraries for PQC signature implementation in Transit
* ui/dashboard: Reorganized dashboard widgets to improve layout and usability. Updated widgets to use HDS table components for better consistency. Enhanced the Quick Actions card with frequently used links alongside existing actions.
* ui: Set pagination size to 10 for custom messages list view and toggle the "Apply filters" button visibility based on filter selection.
* ui: Update copy on merge entities page to specify entity ID is the required data input when merging entities.
* ui: add validations to the ACL visual policy editor to prevent it from saving policies with empty paths or capabilities.
BUG FIXES:
* auth/aws: fix bug where rotation and wif config updates were not persisted to storage
* client/ocsp: Adds a grace period to renew the cached entry for OCSP response.
* core: Fix failure to detect errors during storage writes of totp keys.
* database/mssql: Fix "sysadmin" requirement during lease revocation by replacing the undocumented `sp_msloginmappings` procedure with a granular metadata query. This allows the plugin to function with `VIEW ANY DEFINITION` instead of full `sysadmin` privileges.
* database/mssql: Fix dynamic secret revocation by executing custom statements as a single batch instead of splitting on semicolons
* database/snowflake: Fix WAL rollback issue for key-pair root credential rotation.
* database: prevent static role rotation and connection init from hanging indefinitely when database calls block by adding timeouts around UpdateUser and Initialize
* events (enterprise): Fix panic when replicating lease events.
* go-plugin: Upgrade go-plugin to fix a bug where file descriptors could be leaked when spawning external plugins
* identity: fixed a rare but possible data race issue with identities.
* sdk: Small bugfixes relating to docker test container cleanup and image building.
* secrets-sync (enterprise): Fix destination PATCH handling for WIF identity_token_ttl normalization and GCP service_account_email decoding.
* secrets/kmip (enterprise): Address a nil pointer within the invalidation handler for managed objects.
* secrets/ldap: enable proper license checking on 'openldap' plugin alias. This enables enterprise features when configuring mounts with the 'openldap' alias.
* secrets/pki (enterprise): Fix SCEP nonce logging in audit data.
* secrets/pki (enterprise): Include root CA in chain for CIEPS endpoints when root is the direct issuer, unless `remove_roots_from_chain` is true.
* secrets/pki: Remove invalid value from the supported list of ACME algorithms.
* ui: Add name field validation to LDAP create and edit roles forms.
* ui: Fix LDAP hierarchical role navigation in UI
* ui: Fix entities page to show success message after successfully editing an entity.
* ui: Fix secrets to secrets-engines redirect for bookmarked URLs.
* ui: Fixed custom messages list to display the expiration time on Inactive message badges.
* ui: Fixed sidebar navigation animation issues
* ui: Restore re-sizable columns for secrets and namespaces tables.
* ui: Update DR operation token generation to accept a primary root token for authentication.
* ui: Update KV max_version validation to disallow negative values.
## 2.0.0
### April 14, 2026
BREAKING CHANGES:
* sdk/helpers/docker: Migrate docker helpers from github.com/docker/docker to github.com/moby/moby. This was necessary as github.com/docker/docker is no longer maintained. Resolves GHSA-x744-4wpc-v9h2 and GHSA-pxq6-2prw-chj9.
SECURITY:
* Upgrade `cloudflare/circl` to v1.6.3 to resolve CVE-2026-1229
* Upgrade `filippo.io/edwards25519` to v1.1.1 to resolve GO-2026-4503
* api/auth/gcp: Update go.opentelemetry.io/otel/sdk to fix CVE-2026-39883.
* api/auth: Update github.com/go-jose/go-jose to fix security vulnerability CVE-2026-34986 and GHSA-78h2-9frx-2jm8.
* auth/aws: fix an issue where a user may be able to bypass authentication to Vault due to incorrect caching of the AWS client
* auth/cert: ensure that the certificate being renewed matches the certificate attached to the session.
* core: Correctly remove any Vault tokens from the Authorization header when this header is forwarded to plugin backends. The header will only be forwarded if "Authorization" is explicitly included in the list of passthrough request headers.
* core: Resolve GO-2026-4518 and GHSA-jqcq-xjh3-6g23 by upgrading to github.com/jackc/pgx/v5
* core: Update github.com/aws/aws-sdk-go-v2/ to fix security vulnerability GHSA-xmrv-pmrh-hhx2.
* core: Update github.com/go-jose/go-jose to fix security vulnerability CVE-2026-34986 and GHSA-78h2-9frx-2jm8.
* core: Update github.com/hashicorp/go-getter to fix security vulnerability GHSA-92mm-2pjq-r785.
* core: Update go.opentelemetry.io/otel/sdk to fix CVE-2026-39883.
* core: reject URL-encoded paths that do not specify a canonical path
* http: Added configurable `max_token_header_size` listener option (default 8 KB) to bound the size of authentication token headers (`X-Vault-Token` and `Authorization: Bearer`), preventing a potential denial-of-service attack via oversized header contents. The stdlib-level `MaxHeaderBytes` backstop is also now set on the HTTP server. Set `max_token_header_size = -1` to disable the limit.
* sdk: Resolve GO-2026-4518 and GHSA-jqcq-xjh3-6g23 by upgrading to github.com/jackc/pgx/v5
* sdk: Update github.com/go-jose/go-jose to fix security vulnerability CVE-2026-34986 and GHSA-78h2-9frx-2jm8.
* ui: disable scarf analytics for ui builds
* vault/sdk: Upgrade `cloudflare/circl` to v1.6.3 to resolve CVE-2026-1229
* vault/sdk: Upgrade `go.opentelemetry.io/otel/sdk` to v1.40.0 to resolve GO-2026-4394
* Update github.com/dvsekhvalnov/jose2go to fix security vulnerability CVE-2025-63811.
* go: update to golang/x/crypto to v0.45.0 to resolve GHSA-f6x5-jh6r-wrfv, GHSA-j5w8-q4qc-rx2x, GO-2025-4134 and GO-2025-4135.
CHANGES:
* secrets/ldap (enterprise): Static roles will be migrated from a plugin-managed queue to the Vault Enterprise Rotation Manager system. Static role migration progress can be checked and managed through a new static-migration endpoint. See the [LDAP documentation](https://developer.hashicorp.com/vault/docs/secrets/ldap#static-role-migration-to-rotation-manager) for more details on this process.
* audit: A new top-level key called `supplemental_audit_data` can now appear within audit entries of type "response" within the request and response data structures. These new fields can contain data that further describe the request/response data and are mainly used for non-JSON based requests and responses to help auditing. The `audit-non-hmac-request-keys` and `audit-non-hmac-response-keys` apply to keys within `supplemental_audit_data` to remove the HMAC of the field values if so desired.
* auth/alicloud: Update plugin to [v0.23.1](https://github.com/hashicorp/vault-plugin-auth-alicloud/releases/tag/v0.23.1)
* auth/azure: Update plugin to [v0.24.0](https://github.com/hashicorp/vault-plugin-auth-azure/releases/tag/v0.24.0)
* auth/cf: Update plugin to [v0.23.0](https://github.com/hashicorp/vault-plugin-auth-cf/releases/tag/v0.23.0)
* auth/gcp: Update plugin to [v0.23.1](https://github.com/hashicorp/vault-plugin-auth-gcp/releases/tag/v0.23.1)
* auth/jwt: Update plugin to [v0.26.1](https://github.com/hashicorp/vault-plugin-auth-jwt/releases/tag/v0.26.1)
* auth/kerberos: Update plugin to [v0.17.1](https://github.com/hashicorp/vault-plugin-auth-kerberos/releases/tag/v0.17.1)
* auth/kubernetes: Update plugin to [v0.24.1](https://github.com/hashicorp/vault-plugin-auth-kubernetes/releases/tag/v0.24.1)
* auth/oci: Update plugin to [v0.21.1](https://github.com/hashicorp/vault-plugin-auth-oci/releases/tag/v0.21.1)
* auth/saml: Update plugin to v0.8.1
* core/managed-keys (enterprise): The response to API endpoint GET sys/managed-keys/:type/:name now returns an array of string values for key usages, rather than an array of integer values. The strings used are 'encrypt' (1), 'decrypt' (2), 'sign' (3), 'verify' (4), 'wrap' (5), 'unwrap' (6), 'generate_random' (7), and 'mac' (8).
* core: Bump Go version to 1.26.2
* core: Vault now rejects paths that are not canonical, such as paths containing double slashes (`path//to/resource`)
* core: bump github.com/hashicorp/cap to v0.12.0
* core: secondary DR requests can now be authenticated using a root token generated on the primary.
* core: sys/generate-root and sys/replication/dr/secondary/generate-operation-token endpoints are now authenticated by default, with the old unauthenticated behaviour enabled by setting the new HCL config key enable_unauthenticated_access to include the value "generate-root" or "generate-operation-token" respectively.
* core: sys/rekey endpoints are now authenticated by default, with the old unauthenticated behaviour enabled by setting the new HCL config key enable_unauthenticated_access to include the value "rekey".
* database/couchbase: Update plugin to [v0.16.1](https://github.com/hashicorp/vault-plugin-database-couchbase/releases/tag/v0.16.1)
* database/elasticsearch: Update plugin to [v0.20.1](https://github.com/hashicorp/vault-plugin-database-elasticsearch/releases/tag/v0.20.1)
* database/mongodbatlas: Update plugin to [v0.17.1](https://github.com/hashicorp/vault-plugin-database-mongodbatlas/releases/tag/v0.17.1)
* database/redis-elasticache: Update plugin to [v0.9.1](https://github.com/hashicorp/vault-plugin-database-redis-elasticache/releases/tag/v0.9.1)
* database/redis: Update plugin to [v0.8.1](https://github.com/hashicorp/vault-plugin-database-redis/releases/tag/v0.8.1)
* database/snowflake: Update plugin to [v0.16.0](https://github.com/hashicorp/vault-plugin-database-snowflake/releases/tag/v0.16.0)
* license utilization reporting (enterprise): Manual reporting bundles generated by `vault operator utilization` have a changed format. Notably they contain an array of `snapshot_records` instead of `snapshots`. The `decoded_snapshot` field in each record contains the human-readable data that was previously in the `snapshots` array.
* mfa/duo: Upgrade duo_api_golang client to 0.2.0 to include the new Duo certificate authorities
* packaging: Container images are now exported using a compressed OCI image layout.
* packaging: UBI container images are now built on the UBI 10 minimal image.
* secrets/ad: Update plugin to [v0.22.1](https://github.com/hashicorp/vault-plugin-secrets-ad/releases/tag/v0.22.1)
* secrets/alicloud: Update plugin to [v0.22.1](https://github.com/hashicorp/vault-plugin-secrets-alicloud/releases/tag/v0.22.1)
* secrets/azure: Update azure enterprise secrets plugin to include static roles.
* secrets/azure: Update plugin to v0.25.1+ent. Improves retry handling during Azure application and service principal creation to reduce transient failures.
* secrets/azure: Update plugin to v0.26.1+ent
* secrets/gcp: Update plugin to [v0.24.0](https://github.com/hashicorp/vault-plugin-secrets-gcp/releases/tag/v0.24.0)
* secrets/gcpkms: Update plugin to [v0.23.0](https://github.com/hashicorp/vault-plugin-secrets-gcpkms/releases/tag/v0.23.0)
* secrets/keymgmt: Update plugin to [v0.19.0+ent](https://github.com/hashicorp/vault-plugin-secrets-keymgmt/releases/tag/v0.19.0+ent)
* secrets/kmip: Update plugin to v0.20.0
* secrets/kubernetes: Update plugin to [v0.13.1](https://github.com/hashicorp/vault-plugin-secrets-kubernetes/releases/tag/v0.13.1)
* secrets/kv: Update plugin to [v0.26.2](https://github.com/hashicorp/vault-plugin-secrets-kv/releases/tag/v0.26.2)
* secrets/mongodbatlas: Update plugin to [v0.17.1](https://github.com/hashicorp/vault-plugin-secrets-mongodbatlas/releases/tag/v0.17.1)
* secrets/openldap: Update plugin to [v0.18.0](https://github.com/hashicorp/vault-plugin-secrets-openldap/releases/tag/v0.18.0)
* secrets/pki: sign-verbatim endpoints no longer ignore basic constraints extension in CSRs, using them in generated certificates if isCA=false or returning an error if isCA=true
* secrets/terraform: Update plugin to [v0.14.1](https://github.com/hashicorp/vault-plugin-secrets-terraform/releases/tag/v0.14.1)
* secure-plugin-api: Update to v0.2.0
* storage: Upgrade aerospike client library to v8.
* ui/secrets: Secrets engines url paths renamed from '/secrets' to '/secrets-engines'
* ui: Remove ability to bulk delete secrets engines from the list view.
FEATURES:
* **PKI External CA (Enterprise)**: A new plugin that provides the ability to acquire PKI certificates from Public CA providers through the ACME protocol
* **IBM PAO License Integration**: Added IBM PAO license support, allowing usage of Vault Enterprise with an IBM PAO license key. A new configuration stanza `license_entitlement` is required in the Vault config to use an IBM license. For more details, see the [License documentation](https://developer.hashicorp.com/vault/docs/license#ibm-pao-license-keys).
* **KMIP Bring Your Own CA**: Add new API to manage multiple CAs for client verification and make it possible to import external CAs.
* **LDAP Secrets Engine Enterprise Plugin**: Add the new LDAP Secrets Engine Enterprise plugin. This enterprise version adds support for self-managed static roles and Rotation Manager support for automatic static role rotation. New plugin configurations can be set as "self managed", skipping the requirement for a bindpass field and allowing static roles to use their own password to rotate their credential. Automated static role credential rotation supports fine-grained scheduled rotations and retry policies through Vault Enterprise.
* **Login MFA TOTP Self-Enrollment (Enterprise)**: Simplify creation of login MFA TOTP credentials for users, allowing them to self-enroll MFA TOTP using a QR code (TOTP secret) generated during login. The new functionality is configurable on the TOTP login MFA method configuration screen and via the `enable_self_enrollment` parameter in the API.
* **Plugins (Enterprise)**: Allow overriding pinned version when creating and updating database engines
* **Plugins (Enterprise)**: Allow overriding pinned version when enabling and tuning auth and secrets backends
* **SCIM 2.0 Identity Provisioning Beta (Beta/Enterprise)**: Adds beta support for Vault to act as a SCIM 2.0 server, allowing external management of Vault entities, aliases and groups.
* **Template Integration for PublicPKICA**: Vault Agent templates are now automatically re-rendered when a PKI external CA certificate is issued or renewed.
* **UI ACL Policies intro**: Onboarding intro which provides feature context to users.
* **UI Authentication methods intro**: Onboarding intro which provides feature context to users.
* **UI Namespace Wizard (Enterprise)**: Onboarding wizard which provides advice to users based on their intended usage and guides them through namespace creation.
* **UI Policy Generator (Enterprise)**: Adds policy generator flyout to KV V2 and PKI secrets engines prepopulated with relevant API requests for each page.
* **UI Secret engines intro**: Onboarding intro which provides feature context to users.
* **UI TLS Certificate login**: Add UI login support for the TLS certificate (cert) authentication.
* **UI: Hashi-Built External Plugin Support**: Recognize and support Hashi-built plugins when run as external binaries
* **UI: Hashi-Built External Plugin Support**: Support external plugin version updates via the GUI.
* **UI: Mount versioned external plugins**: Adds ability to mount previously registered, external plugins and specify a version when enabling secrets engines.
* **Vault Agent: ACME protocol support**: Add support to natively support Public CA ACME workflows
* secrets-sync: implemented workload identity federation support for secrets sync flows.
IMPROVEMENTS:
* **Secrets Engines UI improvement**: Updated configuration views and added tune support for configurations across all compatible secrets engines.
* **Sidebar UI improvement**: Add top navbar, update sidebar navigation structure, and update page headers.
* api: Add a SHA256 sum field to the json list response for external plugins.
* api: Added sudo-permissioned `sys/reporting/scan` endpoint which will output a set of files containing information about Vault state to the location specified by the `reporting_scan_directory` config item.
* auth/ldap: Require non-empty passwords on login command to prevent unauthenticated access to Vault.
* config/listener: logs warnings on invalid x-forwarded-for configurations.
* consumption-billing: Adds a new `sys/billing/overview` endpoint that returns current and previous month consumption billing metrics. Accessible via API client method `client.Sys().BillingOverview()`.
* core (enterprise): Add common_criteria_mode feature_flags setting which limits listener TLS cipher suites.
* core (enterprise): Added a new telemetry metric `vault.core.license.termination_time_epoch`.
* core (enterprise): enable rotation manager to send rotation information required by plugin backends during registration and rotation operations. This allows plugin backends to have the necessary context for managing their rotation state effectively.
* core (enterprise): enable rotation manager to use configurable retry policies to limit the retry behavior for rotation entries and include an orphaning mechanism to handle entries that exceed the maximum retry attempts.
* core (enterprise): improve rotation manager error handling by implementing a backoff when re-queueing failed rotations
* core/identity: Add two new fields to the alias API, external_id and issuer. These fields do not inherently do anything meaningful, and are part of a future feature.
* core/managed-keys (enterprise): Allow GCP managed keys to leverage workload identity federation credentials
* core/metrics: Reading and listing from a snapshot are now tracked via the `vault.route.read-snapshot.{mount_point}` and `vault.route.list-snapshot.{mount_point}` metrics.
* core/seal: Enhance sys/seal-backend-status to provide more information about seal backends.
* core: check rotation manager queue every 5 seconds instead of 10 seconds to improve responsiveness
* dockerfile: container will now run as vault user by default
* events (enterprise): Add event notifications support for lease events.
* events (enterprise): Forward event notifications from primary to secondary clusters
* kmip (enterprise): Add experimental API to execute KMIP requests.
* license utilization reporting (enterprise): Add metrics for the number of issued PKI certificates.
* license utilization reporting (enterprise): Utilization reports now include new license metadata fields `issuer`, `edition`, `add_ons`, `license_start_time`, `license_expiration_time`, and `license_termination_time`.
* license utilization reporting: Added consumption billing metrics.
* pki: Reject obviously unsafe validation targets during ACME HTTP-01 and TLS-ALPN-01 challenge verification
* policies: add warning about list comparison when using allowed_parameters or denied_parameters
* rotation: Ensure rotations for shared paths only execute on the Primary cluster's active node. Ensure rotations for local paths execute on the cluster-local active node.
* sdk/rotation: Prevent rotation attempts on read-only storage
* sdk: Add NewTestDockerCluster support for running external plugins within the same container as the server. Also add support for those plugins to expose their own listeners, as KMIP does.
* sdk: Add alias_metadata to tokenutil fields that auth method roles use.
* secret-sync (enterprise): Added telemetry counters for reconciliation loop operations, including the number of corrections detected, retry attempts, and operation outcomes (success or failure with internal/external cause labels).
* secret-sync (enterprise): Added telemetry counters for sync/unsync operations with status breakdown by destination type, and exposed operation counters in the destinations list API response.
* secret-sync: add parallelization support to sync and unsync operations for secret-key granularity associations
* secrets-pki (enterprise): Add response data in a parsed format to the audit log for enrollment protocols.
* secrets-sync (enterprise): Added support for a boolean force_delete flag (default: false). When set to true, this flag allows deletion of a destination even if its associations cannot be unsynced. This option should be used only as a last-resort deletion mechanism, as any secrets already synced to the external provider will remain orphaned and require manual cleanup.
* secrets-sync (enterprise): Improved the user experience during mount lifecycle changes by triggering immediate unsyncing of external secrets when a secrets engine mount is deleted or disabled. By moving this logic from the background reconciliation loop to a direct callback, the system prevents perceived "leaks" and ensures external secret resources are cleaned up synchronously with the Vault unmount.
* secrets/database: Add root rotation support for Snowflake database secrets engines using key-pair credentials.
* secrets/keymgmt (enterprise): Add support for multi-region AWS KMS keys.
* secrets/kmip (Enterprise): Obey configured best_effort_wal_wait_duration when forwarding kmip requests.
* secrets/ldap: Users can now fully manage and tune the LDAP secrets engine. This includes the ability to view, edit, and configure the LDAP engine.
* secrets/pki (enterprise): Return the POSTPKIOperation capability within SCEP GetCACaps endpoint for better legacy client support.
* secrets/pki (enterprise): Validate entire chain in common criteria mode; add field to enable time checks on validation
* secrets/pki (enterprise): When the common_criteria_mode feature flag is enabled, NotBefore will always be treated as zero.
* secrets/pki (enterprise): When the common_criteria_mode feature flag is enabled, enforce a minimum set of key usages for each ext key usage set based on RFC 5280 Section 4.2.1.12 during PKI role updates.
* secrets/pki: Add ACME configuration fields challenge_permitted_ip_ranges and challenge_excluded_ip_ranges configuration to control which IP addresses are allowed or disallowed for challenge validation.
* secrets/pki: Add Freshest CRL extension (Delta CRL Distribution Points) to base CRLs
* secrets/pki: Avoid loading issuer information multiple times per leaf certificate signing
* secrets/pki: Include the certificate's AuthorityKeyID in response fields for API endpoints that issue, sign, or fetch certs.
* secrets/pki: OCSP populate details of the response within the new `supplemental_audit_data` section of audit log response entries. Details such as issuer_id, next_update, ocsp_status, serial_number, revoked_at will appear as hmac values by default unless added to the mount's `audit-non-hmac-response-keys` set of keys.
* secrets/pki: when in common criteria mode, don't allow upload of certificates without a chain of trust.
* secrets/transit, core: Boost the limit of random bytes retrievable via random byte APIs. And add the option to get PRNG random bytes seeded by random sources. Note that requests for large numbers of bytes will increase Vault memory usage accordingly.
* secrets/transit: Improve import errors for non-PKCS#8 keys to clearly require PKCS#8.
* sys (enterprise): Add sys/billing/certificates API endpoint to retrieve the number of issued PKI certificates.
* transit (enterprise): Add context parameter to datakeys and derived-keys endpoint, to allow derived key encryption of the DEKs.
* ui/activity (enterprise): Add clarifying text to explain the "Initial Usage" column will only have timestamps for clients initially used after upgrading to version 1.21
* ui/activity (enterprise): Allow manual querying of client usage if there is a problem retrieving the license start time.
* ui/activity (enterprise): Reduce requests to the activity export API by only fetching new data when the dashboard initially loads or is manually refreshed.
* ui/activity (enterprise): Support filtering months dropdown by ISO timestamp or display value.
* ui/activity: Display total instead of new monthly clients for HCP managed clusters
* ui/pki: Adds support to configure `server_flag`, `client_flag`, `code_signing_flag`, and `email_protection_flag` parameters for creating/updating a role.
* ui: Add "Configuration path" and "Configuration metadata path" fields to KV v2 secret paths page showing paths without /v1/ prefix for use in policies, Vault Agent configurations, and other tools that reference the logical path.
* ui: After clicking Save or Discard in the unsaved changes modal, the user will now navigate to the intended destination link.
* ui: Display errors consistently across the application and show API messages where available.
* ui: Update the sidenav design and add top navbar.
BUG FIXES:
* activity (enterprise): sys/internal/counters/activity outputs the correct mount type when called from a non root namespace
* agent/pkiexternalca: Fix token distribution to PKI system and HTTP-01 challenge server shutdown preventing certificate acquisition and retries
* agent: Fix Vault Agent discarding cached tokens on transient server errors instead of retrying
* audit/file: The logic preventing setting of executable bits on audit devices was enforced at unseal instead of just at new audit device creation, causing an error at unseal if an existing audit device had exec permissions. The logic now warns and clears exec bits to prevent unseal errors.
* auth/approle (enterprise): Fixed bug that prevented periodic tidy running on performance secondary
* auth/approle (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth/aws (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth/cert (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth/gcp: Fix intermittent context canceled failures for Workload Identity Federation (WIF) authentication
* auth/github (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth/ldap (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth/okta (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth/radius (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth/scep (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth/spiffe: Address an issue updating a role with overlapping workload_id_pattern values it previously contained.
* auth/userpass (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth: fixed panic when suppling integer as a lease_id in renewal.
* core (Enterprise): fix unaligned atomic panic in replication code on 32-bit platforms.
* core (enterprise): Avoid duplicate seal rewrapping, and ensure that cluster secondaries rewrap after a seal migration.
* core (enterprise): Buffer the POST body on binary paths to allow re-reading on non-logical forwarding attempts. Addresses an issue for SCEP, EST and CMPv2 certificate issuances with slow replication of entities
* core (enterprise): Fix crash when seal HSM is disconnected
* core/activitylog (enterprise): Resolve a stability issue where Vault Enterprise could encounter a panic during month-end billing activity rollover.
* core/identity (enterprise): Fix excessive logging when updating existing aliases
* core/managed-keys (enterprise): Fix a bug that prevented the max_parallel field of PKCS#11 managed keys from being updated.
* core/managed-keys (enterprise): Fix a problem that prevented 'mac' and 'generate_random' key usages from being set.
* core/managed-keys (enterprise): client credentials should not be required when using Azure Managed Identities in managed keys.
* core/rotation: avoid shifting timezones by ignoring cron.SpecSchedule
* core: Fix bug where background thread to clean the MFA response auth queue runs on PR and DR secondaries.
* core: interpret all new rotation manager rotation_schedules as UTC to avoid inadvertent use of tz-local
* default-auth: Fix issue when specifying "root" explicitly in Default Auth UI
* events (enterprise): Fix missed events when multiple event clients specify the same namespace and event type filters and one client disconnects.
* http: skip JSON limit parsing on cluster listener
* identity: Fix issue where Vault may consume more memory than intended under heavy authentication load.
* identity: Repair the integrity of duplicate and/or dangling entity aliases.
* kmip (enterprise): Fix a bug that would cause a panic on Create Key Pair operations that specify no attributes for the private or the public key.
* ldap auth (enterprise): Fix root password rotation for Active Directory by implementing UTF-16LE encoding and schema-specific handling. Adds new 'schema' config field (defaults to 'openldap' for backward compatibility).
* logging: Fixed an issue where the `log_requests_level` configuration was not respected on a SIGHUP reload when set to "off" or removed from the config file.
* plugins (enterprise): Fix bug where requests to external plugins that modify storage weren't populating the X-Vault-Index response header.
* plugins: Fix regression in plugin sdk where external plugins may panic when doing storage writes/deletes.
* quotas: Vault now protects plugins with ResolveRole operations from panicking on quota creation.
* replication (enterprise): fix rare panic due to race when enabling a secondary with Consul storage.
* rotation: Fix a bug where a performance secondary would panic if a write was made to a local mount
* secret sync (enterprise): fix panic in set-association API when using Vault Proxy with token-bound CIDRs. The panic occurred due to missing connection information during CIDR validation.
* secret sync (enterprise): fixed panic due to nil pointer dereference when reconciling associations. Added guard checks to prevent access to nil references, making association handling more robust.
* secret-sync (enterprise): Fix race condition in secretsSetRemoveHandler by serializing MemDB transaction access.
* secret-sync (enterprise): Improved unsync error handling by treating cases where the destination no longer exists as successful.
* secrets (pki): Allow issuance of certificates without the server_flag key usage from SCEP, EST and CMPV2 protocols.
* secrets-sync (enterprise): Corrected a bug where the deletion of the latest KV-V2 secret version caused the associated external secret to be deleted entirely. The sync job now implements a version fallback mechanism to find and sync the highest available active version, ensuring continuity and preventing the unintended deletion of the external secret resource.
* secrets-sync (enterprise): Fix issue where secrets were not properly un-synced after destination config changes.
* secrets-sync (enterprise): Fix issue where sync store deletion could be attempted when sync is disabled.
* secrets-sync: secrets-sync APIs return appropriate client side error codes when the request is invalid.
* secrets/azure: Ensure proper installation of the Azure enterprise secrets plugin.
* secrets/pki (enterprise): Address cache invalidation issues with CMPv2 on performance standby nodes.
* secrets/pki (enterprise): Address issues using SCEP on performance standby nodes failing due to configuration invalidation issues along with errors writing to storage
* secrets/pki (enterprise): Fix SCEP related digest errors when requests contained compound octet strings
* secrets/pki (enterprise): Modify the SCEP GetCACaps endpoint to dynamically reflect the configured encryption and digest algorithms.
* secrets/pki: Return error when issuing/signing certs whose NotAfter is before NotBefore or whose validity period isn't contained by the CA's.
* secrets/pki: The root/sign-intermediate endpoint max_path_length parameter is now restricted by the signing CA's max_path_length if set.
* secrets/pki: The root/sign-intermediate endpoint should not fail when provided a CSR with a basic constraint extension containing isCa set to true
* secrets/pki: Warn if the Country field on roles and when generating CAs is not ISO 3166 compliant
* secrets/pki: allow glob-style DNS names in alt_names.
* secrets/transit (enterprise): Fix bugs that prevent using ML-DSA and SLH-DSA keys after reading the policy from storage.
* secrets/transit: Fix nil pointer panic when restoring malformed backup data.
* ui (enterprise): Fix KV v2 not displaying secrets in namespaces.
* ui (enterprise): Fixes login form so input renders correctly when token is a preferred login method for a namespace.
* ui/pki: Fixes certificate parsing of the `key_usage` extension so details accurately reflect certificate values.
* ui/pki: Fixes creating and updating a role so `basic_constraints_valid_for_non_ca` is correctly set.
* ui: Fix KV v2 metadata list request failing for policies without a trailing slash in the path.
* ui: Fix secrets table pagination when switching page sizes.
* ui: Fixes login form so `?with=<path>` query param correctly displays only the specified mount when multiple mounts of the same auth type are configured with `listing_visibility="unauth"`
* ui: Resolved a regression that prevented users with create and update permissions on KV v1 secrets from opening the edit view. The UI now correctly recognizes these capabilities and allows editing without requiring full read access.
* ui: Reverts Kubernetes CA Certificate auth method configuration form field type to file selector
* ui: Update LDAP accounts checked-in table to display hierarchical LDAP libraries
* ui: Update LDAP library count to reflect the total number of nodes instead of number of directories
* ui: fix renew token button rendering for denied renew-self.
* ui: remove unnecessary 'credential type' form input when generating AWS secrets
## 1.21.13 Enterprise
### October 22, 2026
SECURITY:
* containers/alpine: Upgrade ca-certificates-bundle to 20261020-r0 to distrust eMudhra intermediate chains.
* containers/UBI: explicitly disallow emSign Root CA and Comodo AAA Services in the CA trust store to distrust eMudhra intermediate chains.
* core/policy: Fixed a cache-key collision vulnerability that could cause policy-name aliases to resolve to the immutable root policy. Root-policy aliases are now explicitly rejected at entity, group, token, authentication-response, and agent-registry policy assignment boundaries. Previously accepted root-equivalent policy aliases (e.g., "./root", "a/../root") are now rejected.
CHANGES:
* api: Removed the `hcp_link_status` and `hcp_link_resource_ID` fields from the `sys/seal-status` response.
* cli: `vault operator diagnose` no longer runs an HCP Link connectivity check, and `vault status` no longer shows HCP Link status.
* core: Bump Go version to 1.26.10 to resolve CVE-2026-111943.
* core: Removed support for HCP Link, which connected self-managed Vault clusters to the HashiCorp Cloud Platform (HCP). Vault no longer starts an HCP Link connection, and the `cloud` stanza in the server configuration no longer has any effect and will be unrecognized.
BUG FIXES:
* core/quotas (enterprise): Fixed a bug where role-based quotas would fail to determine roles where the role is stored as `form-data`.
* core/snapshots: Fix issue during single item snapshot restore operations where snapshot locks were being checked prior to authentication, resulting in some failed requests not being audited.
* managed-keys (enterprise): Fix wrapper error in using managed keys for MACs
* secrets/database/mssql: Safely quote database and user identifiers during default user revocation and parameterize principal lookups, so that logins whose names contain characters outside the database code page are removed rather than left disabled. Default password rotation now quotes the username and escapes the password.
storage/mssql, storage/mysql: Escape configured SQL identifiers when constructing storage queries.
* transit (enterprise): Fix key check to allow use of managed keys for HMAC
## 1.21.12 Enterprise
### October 07, 2026
BREAKING CHANGES:
* pki: ACME finalization with the default `sign-verbatim` directory policy now rejects CSRs that contain URI SANs, email SANs, or Other SANs. ACME challenges only verify DNS names and IP addresses; those SAN types are never validated and must not appear in issued certificates. Operators who require the previous behaviour can set `default_directory_policy = "sign-verbatim-unsafe"` in `config/acme`, accepting that the resulting certificates may contain unverified identity claims.
SECURITY:
* core (enterprise): Prevent policy-name canonicalization bypasses in ACL parameter restrictions.
* core/plugin: Fix plugin catalog entries restored from a raft snapshot, written through `sys/raw`, or replicated being able to run a binary outside `plugin_directory`.
* core/policy: Harden request-time ACL construction to ignore malformed legacy policy references containing path-navigation segments (`.` or `..`) so traversal-style names are never resolved or applied.
* core: Fixed a bypass of exact-deny ACL policies where case-variant AppRole, AWS, Azure, GCP, Kubernetes, SCEP, or TPM role names, GitHub team or user policy mapping keys, certificate or CRL names, ACL/RGP/EGP policy names, or userpass usernames could evade the deny and be resolved by the backend to the same protected resource. Okta group names, LDAP and RADIUS names on mounts left in their default case-insensitive configuration, and Enterprise SCIM client names (`identity/scim/client/<name>`, where a case-variant write overwrites the existing client) are not covered by this fix and remain subject to the same bypass; avoid combining a wildcard allow with an exact deny on those mounts and paths.
CHANGES:
* core/plugin: Plugin catalog entries are now checked against `plugin_directory` whenever they are used, not only at registration. An entry whose command resolves outside the directory, including through a symlink, is refused with `plugin command is outside of configured plugin directory`, and mounts that use it are skipped at startup while keeping their data. Such plugins must be registered again with their binary inside `plugin_directory`.
* core/policy: Vault now validates policy names with segment-aware checks. Empty names and names containing `.` or `..` path segments are rejected for new policy writes and assignments, while names containing `/` and `\` remain supported. During request-time ACL construction, legacy traversal-style policy references are not applied (treated as invalid and unresolved), which can reduce effective token permissions. Operators should audit and rename affected policies before upgrading.
* core: ACL and Sentinel EGP rule paths targeting a specific AppRole, AWS, Azure, GCP, Kubernetes, SCEP, or TPM role, GitHub team or user policy mapping key, certificate or CRL name, ACL/RGP/EGP policy name, or userpass username are now matched against the lowercased resource name, since these backends resolve those names case-insensitively. A rule written with a mixed-case resource name (for example `auth/approle/role/MyRole`) no longer matches requests for that resource and must be rewritten using the lowercase name (`auth/approle/role/myrole`). The lowercased form is also what Sentinel RGP and EGP policies observe as `request.path`, so policy rules that compare that value against a mixed-case path (for example `request.path is "auth/approle/role/MyRole"`) must be updated as well. External auth and secret plugins are not affected by this normalization and continue to receive requests with their original casing. Existing deny rules using mixed-case resource names will fail open (become allow-all) after upgrade until rewritten with lowercase names.
* ui: Remove HCP Link status indicator following deprecation of HCP Link.
IMPROVEMENTS:
* auth/spiffe (enterprise): Add SPIFFE login cli handler.
* token: Add debug logging for foreign server side consistent token handling
* ui: Remove unused Vercel Storybook artifacts (`vercel.json`, `metadata.json`) left over from the Storybook removal in 2022
* ui: Upgrade Path Analyzer selects latest available version by default and shows state message when the user is already up-to-date.
* ui: Upgrade Path Analyzer surfaces API errors
BUG FIXES:
* identity/entity: Fixed an issue where the `from_entity`'s entity aliases were not properly deleted during entity merges.
* identity: Fix duplicate member_entity_ids entries in external groups when a JWT/OIDC login token carries repeated group-name entries in the groups claim.
* secrets-sync (enterprise): Fix destinations configured with `allowed_ipv4_addresses` or `allowed_ipv6_addresses` failing with `INTERNAL_VAULT_ERROR` after a leadership change, until the destination configuration was reapplied.
* secrets/database (enterprise): Fix cleanup of database plugin sub processes and resources when initialization of the database connection fails.
* secrets/database: Fix missing-credentials error for Database types without self-managed support incorrectly suggesting the self-managed option.
* secrets/transit: fix CSR re-signing to preserve extension Critical flags and prevent malformed ASN.1 output when Subject Alternative Names and extra extensions are both present
* ui: Fixed an issue where enabling a KV secrets engine from a performance standby or performance
secondary displayed an error even though the mount was created successfully. The UI now waits for
the request to be forwarded and the mount to become available before loading the new engine.
## 1.21.11 Enterprise
### September 16, 2026
SECURITY:
* core: Update github.com/apache/thrift to v0.24.0 to fix security vulnerability ghsa-8wv5-x4w7-5gww.
* core: Update golang.org/x/crypto to v0.56.0 to fix security vulnerabilities GO-2026-6354 and GO-2026-6355.
* core: Update google.golang.org/grpc to v1.83.2 to fix security vulnerability GHSA-2v4p-qf9q-27wj.
CHANGES:
* core/raft: Limited concurrent retry-join workers to 20. Any further retry-join attempts while 20 are in progress will result in an error (`too many concurrent raft retry joins in progress`).
* core: Bump Go version to 1.26.8.
IMPROVEMENTS:
* core: Add a `ui_settings` configuration stanza with a `ui_telemetry` option, surfaced to the UI via the `sys/internal/ui/settings` endpoint, that gates anonymous UI usage telemetry.
* secrets/pki: Add `extra_subject_names_oids` field to roles to allow specifying additional OID subject name components.
* secrets/pki: add an additional field to include a RFC 5280 revocation reason for (/pki/revoke) and (/pki/revoke-with-key).
* ui: Bump dompurify to 3.4.15 to address SECVULN advisories
BUG FIXES:
* Secrets Recovery (enterprise): Fixing Vault panic in cli when running `vault recover` without a path.
* auth/approle: Fix `token_bound_cidrs` validation when using /128 blocks for role and secret ID
* core/activitylog (enterprise): Fix a panic in CensusReport ACL policy metrics collection by safely handling transient missing policies and nil policy path/permission data while policies are changing.
* core/mounts: Fixed `vault secrets move` (and `vault auth move`) incorrectly placing a mount in the root namespace when the destination path has a leading slash.
* plugins: Fix issue with `vault plugin reload -mounts` command when run in the root namespace
* secrets-sync (enterprise): Fix `LIST /v1/sys/sync/associations` intermittently returning zero associations/secrets by forwarding the request to the active node instead of allowing it to be served locally by a performance standby or performance secondary.
* secrets/pki (enterprise): Fix panic in CMPv2 sentinel field parsing when cert request messages is empty.
* secrets/pki (enterprise): Fix unified CRL not being rebuilt after the background transfer copies locally-revoked certificates into unified storage.
* ui: Fix total secrets count binding on secrets sync overview page to match the API response key.
* ui: Resolve the flickering on the login page when a trailing slash is added to the namespace in the field.
## 1.21.10 Enterprise
### September 01, 2026
SECURITY:
* core: Update go.etcd.io/etcd/client/pkg/v3 to v3.6.14 to fix security vulnerability GO-2026-6107.
CHANGES:
* core: Bump Go version to 1.25.14.
* secrets/azure: Update plugin to [v0.25.5+ent](https://github.com/hashicorp/vault-plugin-secrets-azure/releases/tag/v0.25.5+ent)
IMPROVEMENTS:
* core/seal (enterprise): Update Oracle Cloud library to enable seal integration with newer regions.
* core: Automatically write a goroutine dump to a temp directory on shutdown (SIGTERM/SIGINT). The output directory can be overridden with `VAULT_STACKTRACE_FILE_PATH`, and the dump can be suppressed with the config field `disable_goroutine_trace_dump`.
* ui: Bump `dompurify` from `3.4.6` to `3.4.13`.
* ui: Bump shell-quote from 1.8.4 to 1.9.0.
* ui: Exposing the RSA Private Key field in the UI when generating credentials with the snowflake database secrets engine. Previously, this field was only shown in the cli.
BUG FIXES:
* api: Account for the HTTP Age header when calculating a lease's remaining lifetime, so that leases read or renewed through a caching proxy such as Vault Agent are renewed before they expire.
* core (enterprise): Fix a data race and potential panic during seal/unseal
* core (enterprise): Fix a data race and potential panic during seal/unseal
* core (enterprise): Fix panic in `collectOperatorImportMetrics` when `router.Route` returns a nil response with no error during KVv2 metadata reads on performance secondary nodes. This condition occurs during the WAL-stream partial-sync phase of an initial join.
* core/login: Fix panic on malformed login requests. Vault now returns an error for malformed login payloads instead of dropping the client connection (no data loss).
* core/metrics: Fixed a bug where log_format = "json" had no effect on telemetry sink errors from statsd and statsite backends.
* core/wrapping: sys/wrapping/wrap now enforces uuid-format wrapping tokens, ignoring any caller-requested wrap format.
* core: Fix `vault operator migrate -start` command when migrating to raft integrated storage.
* core: Standby clusters now populate the `cluster:` field when `sys/metrics` is called.
* default-auth: Fix issue with legacy default-auth configs that would break as part of upgrading to a newer version of Vault.
* plugins: Reading a versioned-only plugin without specifying `-version` now auto-selects it when only one version exists, or returns an error listing available versions, instead of a silent 404.
* proxy/cache (enterprise): Fixed a bug in the static secret cache where `GET` requests with `?list=true` were incorrectly cached and served stale.
* secret/pki: Fix ACME order finalize race condition where concurrent requests could double-issue certificates and orphan one from order-keyed tracking
* secret/pki: prevent key rename from accepting a name already held by a different key.
* secrets/database: Sanitize the caller-controlled DisplayName before it is used in generated usernames to prevent SQL injection via username templates. Adds a configuration warning when a username_template references DisplayName without a truncate function.
* serviceregistration/consul: Fixed an issue where Vault would permanently deregister itself from the Consul service catalog when a SIGHUP/reload signal was sent and the configuration used Consul as the storage backend without an explicit `service_registration` stanza.
* ui: Fix open redirect bug in OIDC provider route.
* ui: add totalItems property to fix filtered list pagination showing incorrect total page count
* ui: fix spurious "No access" banner when navigating to Vault UI with `?namespace=root` in the URL
## 1.21.9 Enterprise
### August 04, 2026
BREAKING CHANGES:
* containers: The following packages have been removed from UBI based container
images: gnupg, openssl, procps.
SECURITY:
* acl: Fix privilege-escalation vulnerability where a `denied_parameters` constraint on the `policies` request field could be bypassed by submitting a mixed-case policy name (e.g. "Super-Admin" instead of "super-admin"). Vault now normalizes the `policies` parameter to lowercase before evaluating `allowed_parameters`/`denied_parameters` constraints.
* identity: Prevent the entity batch-delete endpoint (identity/entity/batch-delete) from deleting the underlying storage of entities that belong to another namespace.
* identity: entity/name updates now reject mismatched id or external_id selectors to prevent retargeting updates to a different entity
CHANGES:
* auth/oci: Update plugin to [v0.20.3](https://github.com/hashicorp/vault-plugin-auth-oci/releases/tag/v0.20.3)
* core: Bump Go version to 1.25.12.
IMPROVEMENTS:
* auth/cert: Support login via x-forwarded cert headers even with tls disabled on the vault listener.
* core (entreprise): Ameriolate sealwrap lock contention for core paths.
* core/acl: Adds a global `deny_slash_in_templated_path` configuration option to reject the presence of slashes in rendered identity templates in policies, defaulting to `false`.
* core/identity: Adds a global `deny_slash_in_templated_path` configuration option to reject the presence of slashes in rendered identity templates in policies, defaulting to `false`.
* core/managed-keys/PKCS#11 (enterprise): Providing a non-empty value for one field while the other is already saved is rejected. To switch addressing modes, you must explicitly clear the old field by sending it as an empty string ("") in the same request alongside the new value.
* core/managed-keys/PKCS#11 (enterprise): slot and token_label are now strictly enforced as mutually exclusive identifiers for an HSM token
* events: Add `VAULT_EVENT_NOTIFICATIONS_BOUNDED_QUEUE_SIZE` environment variable to configure bounded event queues for event notification subscribers. Set to a positive integer (e.g., 16) to enable buffered channels of that size (maximum 1000). This prevents resource exhaustion in deployments with high subscriber counts, but comes at the cost of the potential for subscribers to miss events. Defaults to 0 (unbuffered) for backward compatibility.
* ui: Bump pnpm.overrides entry for `tmp` from 0.2.6 to 0.2.7.
* ui: Bump pnpm.overrides entry for `ws` from 8.20.1 to 8.21.0.
BUG FIXES:
* Proxy/Agent: Fixed a bug where auth method headers accumulated on the shared API client across re-auth cycles.
* Proxy: Fixed a bug where the Vault token header accumulated duplicate values across WebSocket reconnects in the static secret cache updater.
* Secrets Recovery (enterprise): Do not redirect to the active node for list requests to `sys/storage/raft/snapshot-load` or read/delete requests to `sys/storage/raft/snapshot-load/{id}`. If possible, handle these requests on the performance standby, otherwise forward the requests to the active node.
* audit: Fix a regression from CVE-2025-6000 that broke enabling audit devices on Windows when a plugin directory was configured.
* audit: make file and socket audit sink serialization context-aware so canceled or expired requests stop waiting behind blocked audit writes, reducing buildup of goroutines, memory, connections, and file descriptors during audit sink contention
* auth/cert: Add support for x-forwarded cert headers coming from AWS ALBs.
* auth/spiffe (enterprise): Use the full peer certificate chain when verifying certificates.
* aws/auth: Redact EC2 instance metadata values from AWS auth error messages.
* core (enterprise): Fix a bug that causes unnecessary seal rewrapping.
* core (enterprise): Preserve wrapping metadata when Control Group unwrap replays an approved request that returns a wrapped response.
* core (enterprise): Update state checking of Sever-Side Consistent Token (SSCT) when used on performance secondary clusters. 403 response codes will be preferred over 412 for invalid, cross cluster token requests to secondary active nodes.
* core/managed-keys (enterprise): Allow slot numbers above 32 bits in PKCS#11 managed keys.
* core/seal: Fixed goroutine leak occurring when Encryption and Decryption functions time out.
* core: Preserve URL query parameters when redirecting API requests containing duplicate slashes to their canonical path.
Previously, the redirect dropped parameters such as `?list=true`, potentially changing the result of the request.
* events (enterprise): Fix a bug where events stopped being forwarded to performance secondaries after the active node restarted or had a change event (seal/unseal, etc).
* export API: Normalize the end_time parameter in the activity export API to the end of the month to match the behavior stated in the documentation.
* secrets-sync: Fix GCP Secret Manager destinations losing their per-region KMS key on Vault restart.
* secrets-sync: Fixes Custom Tags field in Details view to display keys with empty value
* secrets/transit (enterprise): Add managed key support to CSR sign and set certificate chain endpoints.
## 1.21.8 Enterprise
### June 17, 2026
SECURITY:
* auth/radius: Added case_insensitive_names toggle to prevent username collisions and enable case-insensitive user handling.
* core/acl: Fix LIST ACL bypass where a trailing-slash request could skip a more-specific deny rule.
* core: Use constant-time recovery token comparison
CHANGES:
* auth/cf: Update plugin to [v0.22.1](https://github.com/hashicorp/vault-plugin-auth-cf/releases/tag/v0.22.1)
* core/acl: LIST requests with a trailing slash now correctly respect more-specific deny policies. Previously, a deny on `path "kv/*" { deny }` could be bypassed for `LIST kv/private/` if a broader allow `path "kv/*"` also existed. Policies relying on the previous (incorrect) behavior may now be denied.
* core: Vault will now redirect non-canonicalized paths (containing `/./`, `/../`, or `//`) to a cleaned path, instead of rejecting these requests
IMPROVEMENTS:
* secrets/azure: For dynamic apps, Vault now creates the app and its client secret with a single MS Graph API request, significantly reducing temporary errors caused by Azure eventual consistency
* core (Enterprise): Make deadlock detection in sealwrap configurable by adding "sealwrap" to existing configuration detect_deadlocks.
* ui (enterprise): Migrate charts from Lineal to Carbon Charts in the Client usage overview and Vault usage dashboard.
BUG FIXES:
* core/rotationMgr: Fix storage routing for local mounts in namespaces to prevent metadata replication and ensure GDPR compliance.
* core: Fix failure to detect errors during storage writes of totp keys.
* secret-sync (enterprise): Fix GCP Secret Manager replication policy persistence across Vault restarts.
* secrets/database/mssql: Deregister stale TLS configurations when MySQL connection TLS settings change or the connection is closed, preventing retained certificate pools from accumulating.
* secrets/pki: Fix PKI certificate issuance not_after time to respect max TTL.
* secrets/transit: Add managed key support to Transit rewrap endpoint.
* storage/raft: reject `performance_multiplier` values less than or equal to zero
## 1.21.7 Enterprise
### June 05, 2026
BREAKING CHANGES:
* containers: Remove `cap_ipc_lock` capability on `vault` at build time to allow running Vault in common container runtimes. Vault in containers will no longer be able to call `mlock()` to lock memory. Operators should set `disable_mlock = true` in Vault's configuration. Runtime operators are advised to disable swapping to guarantee data safety.
* secrets/ssh: RSA key sizes are now limited to a maximum size of 8192 bits addressing CVE-2026-39829
CHANGES:
* core: Bump Go version to 1.25.11
* secrets/azure (enterprise): Update plugin to [v0.25.3+ent](https://github.com/hashicorp/vault-plugin-secrets-azure-enterprise/releases/tag/v0.25.3+ent)
BUG FIXES:
* plugins: Fix plugin signature verification failure with expired pgp key when registering a plugin.
* ui/transit: Fix key version dropdown selected state when editing a transit key.
* secret-sync (enterprise): Fix a panic when creating Secrets Sync destinations if `fetch_identity_token` callback fields are present in store configuration.
## 1.21.6 Enterprise
### May 19, 2026
BREAKING CHANGES:
* containers: set cap_ipc_lock capability on vault at build time. Container runtimes will need to add `IPC_LOCK` capabilities when running the vault container.
SECURITY:
* api: Update golang.org/x/net to resolve GO-2026-4918"
* core/identity: reject wildcards in rendered identity templates
* core: Resolve GHSA-j88v-2chj-qfwx by removing our dependency on github.com/jackc/pgx/v3 and github.com/jackc/pgx/v4
* core: Update github.com/Azure/go-ntlmssp to fix security vulnerability v0.1.1.
* core: Update github.com/apache/thrift to fix security vulnerability GHSA-wf45-q9ch-q8gh
* core: Update github.com/jackc/pgx/v5 to fix security vulnerability GHSA-j88v-2chj-qfwx.
* core: Update golang.org/x/net to resolve GO-2026-4918"
* core: Validate both `path` and `file_path` cannot be empty for requests to `sys/audit/{path}`
* sdk: Resolve GHSA-j88v-2chj-qfwx by removing our dependency on github.com/jackc/pgx/v3 and github.com/jackc/pgx/v4
* sdk: Update github.com/Azure/go-ntlmssp to fix security vulnerability v0.1.1.
* sdk: Update github.com/jackc/pgx/v5 to fix security vulnerability GHSA-j88v-2chj-qfwx.
* sdk: Update golang.org/x/net to resolve GO-2026-4918"
CHANGES:
* auth/jwt: Update plugin to [v0.25.1](https://github.com/hashicorp/vault-plugin-auth-jwt/releases/tag/v0.25.1)
* core: Bump Go version to 1.25.10
* identity: Require `sudo` capability to invoke the identity entity merge API endpoint (`identity/entity/merge`).
* secrets/azure: Update plugin to [v0.25.2+ent](https://github.com/hashicorp/vault-plugin-secrets-azure/releases/tag/v0.25.2+ent)
IMPROVEMENTS:
* api: Add migration_done_at_epoch to sys/seal-status response.
* core (Enterprise): Sanitized config now shows kms_library config.
* core/seal (enterprise): Make it possible for new nodes to join a cluster configured with Seal High Availability.
* sdk: Expand support for docker test cluster options like seals, kms libraries, and entropy augmentation. DockerClusterNode.UpdateConfig now takes a full set of cluster options instead of just node config.
* secrets/pki (enterprise): Allow SCEP to use an issuer that is backed by an RSA based PKCS#11 managed key
* ui: `unsafe-inline` is no longer included in the `style-src` CSP directive.
BUG FIXES:
* client/ocsp: Adds a grace period to renew the cached entry for OCSP response.
* database/mssql: Fix "sysadmin" requirement during lease revocation by replacing the undocumented `sp_msloginmappings` procedure with a granular metadata query. This allows the plugin to function with `VIEW ANY DEFINITION` instead of full `sysadmin` privileges.
* database/mssql: Fix dynamic secret revocation by executing custom statements as a single batch instead of splitting on semicolons
* database/snowflake: Fix WAL rollback issue for key-pair root credential rotation.
* database: prevent static role rotation and connection init from hanging indefinitely when database calls block by adding timeouts around UpdateUser and Initialize
* go-plugin: Upgrade go-plugin to fix a bug where file descriptors could be leaked when spawning external plugins
* identity: fixed a rare but possible data race issue with identities.
* plugins/database/hana: Fixed a SQL injection risk in the default DeleteUser revoke path by safely quoting usernames as SQL identifiers before ALTER USER and DROP USER statements.
plugins/database/redshift: Fixed a SQL injection risk in the default DeleteUser revoke path by safely quoting usernames as SQL string literals when invoking terminateloop(...), preventing statement-structure manipulation.
* sdk: Small bugfixes relating to docker test container cleanup and image building.
* secrets/kmip (enterprise): Address a nil pointer within the invalidation handler for managed objects.
* secrets/pki (enterprise): Include root CA in chain for CIEPS endpoints when root is the direct issuer, unless `remove_roots_from_chain` is true.
* ui: Fix LDAP check-out capabilities check.
* ui: Fix entities page to show success message after successfully editing an entity.
* ui: Fix secrets table pagination when switching page sizes.
* ui: Fixed custom messages list to display the expiration time on Inactive message badges.
* ui: Restore re-sizable columns for secrets and namespaces tables.
* ui: Update KV max_version validation to disallow negative values.
## 1.21.5 Enterprise
### April 14, 2026
BREAKING CHANGES:
* sdk/helpers/docker: Migrate docker helpers from github.com/docker/docker to github.com/moby/moby. This was necessary as github.com/docker/docker is no longer maintained. Resolves GHSA-x744-4wpc-v9h2 and GHSA-pxq6-2prw-chj9.
SECURITY:
* api/auth/gcp: Update go.opentelemetry.io/otel/sdk to fix CVE-2026-39883.
* api/auth: Update github.com/go-jose/go-jose to fix security vulnerability CVE-2026-34986 and GHSA-78h2-9frx-2jm8.
* core: Correctly remove any Vault tokens from the Authorization header when this header is forwarded to plugin backends. The header will only be forwarded if "Authorization" is explicitly included in the list of passthrough request headers.
* core: Resolve GO-2026-4518 and GHSA-jqcq-xjh3-6g23 by upgrading to github.com/jackc/pgx/v5
* core: Update github.com/aws/aws-sdk-go-v2/ to fix security vulnerability GHSA-xmrv-pmrh-hhx2.
* core: Update github.com/go-jose/go-jose to fix security vulnerability CVE-2026-34986 and GHSA-78h2-9frx-2jm8.
* core: Update github.com/hashicorp/go-getter to fix security vulnerability GHSA-92mm-2pjq-r785.
* core: Update go.opentelemetry.io/otel/sdk to fix CVE-2026-39883.
* core: reject URL-encoded paths that do not specify a canonical path
* sdk: Resolve GO-2026-4518 and GHSA-jqcq-xjh3-6g23 by upgrading to github.com/jackc/pgx/v5
* sdk: Update github.com/go-jose/go-jose to fix security vulnerability CVE-2026-34986 and GHSA-78h2-9frx-2jm8.
CHANGES:
* core: Bump Go version to 1.25.9
* core: Vault now rejects paths that are not canonical, such as paths containing double slashes (`path//to/resource`)
IMPROVEMENTS:
* config/listener: logs warnings on invalid x-forwarded-for configurations.
* dockerfile: container will now run as vault user by default
* events (enterprise): Forward event notifications from primary to secondary clusters
* pki: Reject obviously unsafe validation targets during ACME HTTP-01 and TLS-ALPN-01 challenge verification
* secrets/pki: Add ACME configuration fields challenge_permitted_ip_ranges and challenge_excluded_ip_ranges configuration to control which IP addresses are allowed or disallowed for challenge validation.
* secrets/pki: Add Freshest CRL extension (Delta CRL Distribution Points) to base CRLs
* secrets/transit: Improve import errors for non-PKCS#8 keys to clearly require PKCS#8.
* transit (enterprise): Add context parameter to datakeys and derived-keys endpoint, to allow derived key encryption of the DEKs.
BUG FIXES:
* audit/file: The logic preventing setting of executable bits on audit devices was enforced at unseal instead of just at new audit device creation, causing an error at unseal if an existing audit device had exec permissions. The logic now warns and clears exec bits to prevent unseal errors.
* auth/gcp: Fix intermittent context canceled failures for Workload Identity Federation (WIF) authentication
* core (Enterprise): fix unaligned atomic panic in replication code on 32-bit platforms.
* core/managed-keys (enterprise): Fix a bug that prevented the max_parallel field of PKCS#11 managed keys from being updated.
* events (enterprise): Fix missed events when multiple event clients specify the same namespace and event type filters and one client disconnects.
* identity: Repair the integrity of duplicate and/or dangling entity aliases.
* ldap auth (enterprise): Fix root password rotation for Active Directory by implementing UTF-16LE encoding and schema-specific handling. Adds new 'schema' config field (defaults to 'openldap' for backward compatibility).
* secret sync (enterprise): fix panic in set-association API when using Vault Proxy with token-bound CIDRs. The panic occurred due to missing connection information during CIDR validation.
* secret sync (enterprise): fixed panic due to nil pointer dereference when reconciling associations. Added guard checks to prevent access to nil references, making association handling more robust.
* secret-sync (enterprise): Fix race condition in secretsSetRemoveHandler by serializing MemDB transaction access.
* secrets/pki: The root/sign-intermediate endpoint max_path_length parameter is now restricted by the signing CA's max_path_length if set.
* secrets/transit (enterprise): Fix bugs that prevent using ML-DSA and SLH-DSA keys after reading the policy from storage.
## 1.21.4
### March 05, 2026
SECURITY:
* Upgrade `cloudflare/circl` to v1.6.3 to resolve CVE-2026-1229
* Upgrade `filippo.io/edwards25519` to v1.1.1 to resolve GO-2026-4503
* vault/sdk: Upgrade `cloudflare/circl` to v1.6.3 to resolve CVE-2026-1229
* vault/sdk: Upgrade `go.opentelemetry.io/otel/sdk` to v1.40.0 to resolve GO-2026-4394
CHANGES:
* core: Bump Go version to 1.25.7
* mfa/duo: Upgrade duo_api_golang client to 0.2.0 to include the new Duo certificate authorities
* ui: Remove ability to bulk delete secrets engines from the list view.
IMPROVEMENTS:
* core/seal: Enhance sys/seal-backend-status to provide more information about seal backends.
* secrets/kmip (Enterprise): Obey configured best_effort_wal_wait_duration when forwarding kmip requests.
* secrets/pki (enterprise): Return the POSTPKIOperation capability within SCEP GetCACaps endpoint for better legacy client support.
BUG FIXES:
* core (enterprise): Buffer the POST body on binary paths to allow re-reading on non-logical forwarding attempts. Addresses an issue for SCEP, EST and CMPv2 certificate issuances with slow replication of entities
* core/identity (enterprise): Fix excessive logging when updating existing aliases
* core/managed-keys (enterprise): client credentials should not be required when using Azure Managed Identities in managed keys.
* plugins (enterprise): Fix bug where requests to external plugins that modify storage weren't populating the X-Vault-Index response header.
* secrets (pki): Allow issuance of certificates without the server_flag key usage from SCEP, EST and CMPV2 protocols.
* secrets/pki (enterprise): Address cache invalidation issues with CMPv2 on performance standby nodes.
* secrets/pki (enterprise): Address issues using SCEP on performance standby nodes failing due to configuration invalidation issues along with errors writing to storage
* secrets/pki (enterprise): Modify the SCEP GetCACaps endpoint to dynamically reflect the configured encryption and digest algorithms.
* secrets/pki: The root/sign-intermediate endpoint should not fail when provided a CSR with a basic constraint extension containing isCa set to true
* secrets/pki: allow glob-style DNS names in alt_names.
## 1.21.3
### February 05, 2026
SECURITY:
* auth/cert: ensure that the certificate being renewed matches the certificate attached to the session.
CHANGES:
* core: Bump Go version to 1.25.6
FEATURES:
* **UI: Hashi-Built External Plugin Support**: Recognize and support Hashi-built plugins when run as external binaries
IMPROVEMENTS:
* core/managed-keys (enterprise): Allow GCP managed keys to leverage workload identity federation credentials
* sdk: Add alias_metadata to tokenutil fields that auth method roles use.
* secret-sync (enterprise): Added telemetry counters for reconciliation loop operations, including the number of corrections detected, retry attempts, and operation outcomes (success or failure with internal/external cause labels).
* secret-sync (enterprise): Added telemetry counters for sync/unsync operations with status breakdown by destination type, and exposed operation counters in the destinations list API response.
BUG FIXES:
* agent: Fix Vault Agent discarding cached tokens on transient server errors instead of retrying
* core (enterprise): Fix crash when seal HSM is disconnected
* default-auth: Fix issue when specifying "root" explicitly in Default Auth UI
* identity: Fix issue where Vault may consume more memory than intended under heavy authentication load.
* secrets/pki (enterprise): Fix SCEP related digest errors when requests contained compound octet strings
* ui: Fixes login form so `?with=<path>` query param correctly displays only the specified mount when multiple mounts of the same auth type are configured with `listing_visibility="unauth"`
* ui: Reverts Kubernetes CA Certificate auth method configuration form field type to file selector
## 1.21.2
### January 07, 2026
CHANGES:
* auth/oci: bump plugin to v0.20.1
* core: Bump Go version to 1.25.5
* packaging: Container images are now exported using a compressed OCI image layout.
* packaging: UBI container images are now built on the UBI 10 minimal image.
* secrets/azure: Update plugin to v0.25.1+ent. Improves retry handling during Azure application and service principal creation to reduce transient failures.
* storage: Upgrade aerospike client library to v8.
IMPROVEMENTS:
* core: check rotation manager queue every 5 seconds instead of 10 seconds to improve responsiveness
* go: update to golang/x/crypto to v0.45.0 to resolve GHSA-f6x5-jh6r-wrfv, GHSA-j5w8-q4qc-rx2x, GO-2025-4134 and GO-2025-4135.
* rotation: Ensure rotations for shared paths only execute on the Primary cluster's active node. Ensure rotations for local paths execute on the cluster-local active node.
* sdk/rotation: Prevent rotation attempts on read-only storage.
* secrets-sync (enterprise): Added support for a boolean force_delete flag (default: false). When set to true, this flag allows deletion of a destination even if its associations cannot be unsynced. This option should be used only as a last-resort deletion mechanism, as any secrets already synced to the external provider will remain orphaned and require manual cleanup.
* secrets/pki: Avoid loading issuer information multiple times per leaf certificate signing.
BUG FIXES:
* core/activitylog (enterprise): Resolve a stability issue where Vault Enterprise could encounter a panic during month-end billing activity rollover.
* http: skip JSON limit parsing on cluster listener.
* quotas: Vault now protects plugins with ResolveRole operations from panicking on quota creation.
* replication (enterprise): fix rare panic due to race when enabling a secondary with Consul storage.
* rotation: Fix a bug where a performance secondary would panic if a write was made to a local mount.
* secret-sync (enterprise): Improved unsync error handling by treating cases where the destination no longer exists as successful.
* secrets-sync (enterprise): Corrected a bug where the deletion of the latest KV-V2 secret version caused the associated external secret to be deleted entirely. The sync job now implements a version fallback mechanism to find and sync the highest available active version, ensuring continuity and preventing the unintended deletion of the external secret resource.
* secrets-sync (enterprise): Fix issue where secrets were not properly un-synced after destination config changes.
* secrets-sync (enterprise): Fix issue where sync store deletion could be attempted when sync is disabled.
* ui/pki: Fix handling of values that contain commas in list fields like `crl_distribution_points`.
## 1.21.1
### November 19, 2025
SECURITY:
* auth/aws: fix an issue where a user may be able to bypass authentication to Vault due to incorrect caching of the AWS client
* ui: disable scarf analytics for ui builds
CHANGES:
* auth/kubernetes: Update plugin to [v0.23.1](https://github.com/hashicorp/vault-plugin-auth-kubernetes/releases/tag/v0.23.1)
* auth/saml: Update plugin to [v0.7.1](https://github.com/hashicorp/vault-plugin-auth-saml/releases/tag/v0.7.1), which adds the environment variable VAULT_SAML_DENY_INTERNAL_URLS to allow prevention of idp_metadata_url, idp_sso_url, or acs_urls fields from containing URLs that resolve to internal IP addresses
* core: Bump Go version to 1.25.4
* secrets/azure (enterprise): Update plugin to v0.25.0+ent
* secrets/pki: sign-verbatim endpoints no longer ignore basic constraints extension in CSRs, using them in generated certificates if isCA=false or returning an error if isCA=true
IMPROVEMENTS:
* Update github.com/dvsekhvalnov/jose2go to fix security vulnerability CVE-2025-63811.
* api: Added sudo-permissioned `sys/reporting/scan` endpoint which will output a set of files containing information about Vault state to the location specified by the `reporting_scan_directory` config item.
* auth/ldap: Require non-empty passwords on login command to prevent unauthenticated access to Vault.
* core/metrics: Reading and listing from a snapshot are now tracked via the `vault.route.read-snapshot.{mount_point}` and `vault.route.list-snapshot.{mount_point}` metrics.
* license utilization reporting (enterprise): Add metrics for the number of issued PKI certificates.
* policies: add warning about list comparison when using allowed_parameters or denied_parameters
* secret-sync: add parallelization support to sync and unsync operations for secret-key granularity associations
* secrets/pki: Include the certificate's AuthorityKeyID in response fields for API endpoints that issue, sign, or fetch certs.
* sys (enterprise): Add sys/billing/certificates API endpoint to retrieve the number of issued PKI certificates.
* ui/activity (enterprise): Add clarifying text to explain the "Initial Usage" column will only have timestamps for clients initially used after upgrading to version 1.21
* ui/activity (enterprise): Allow manual querying of client usage if there is a problem retrieving the license start time.
* ui/activity (enterprise): Reduce requests to the activity export API by only fetching new data when the dashboard initially loads or is manually refreshed.
* ui/activity (enterprise): Support filtering months dropdown by ISO timestamp or display value.
* ui/activity: Display total instead of new monthly clients for HCP managed clusters
* ui/pki: Adds support to configure `server_flag`, `client_flag`, `code_signing_flag`, and `email_protection_flag` parameters for creating/updating a role.
BUG FIXES:
* activity (enterprise): sys/internal/counters/activity outputs the correct mount type when called from a non root namespace
* auth/approle (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth/aws (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth/cert (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth/github (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth/ldap (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth/okta (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth/radius (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth/scep (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth/userpass (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth: fixed panic when supplying integer as a lease_id in renewal.
* core/rotation: avoid shifting timezones by ignoring cron.SpecSchedule
* core: interpret all new rotation manager rotation_schedules as UTC to avoid inadvertent use of tz-local
* secrets/azure: Ensure proper installation of the Azure enterprise secrets plugin.
* secrets/pki: Return error when issuing/signing certs whose NotAfter is before NotBefore or whose validity period isn't contained by the CA's.
* ui (enterprise): Fix KV v2 not displaying secrets in namespaces.
* ui (enterprise): Fixes login form so input renders correctly when token is a preferred login method for a namespace.
* ui/pki: Fixes certificate parsing of the `key_usage` extension so details accurately reflect certificate values.
* ui/pki: Fixes creating and updating a role so `basic_constraints_valid_for_non_ca` is correctly set.
* ui: Fix KV v2 metadata list request failing for policies without a trailing slash in the path.
* ui: Resolved a regression that prevented users with create and update permissions on KV v1 secrets from opening the edit view. The UI now correctly recognizes these capabilities and allows editing without requiring full read access.
* ui: Update LDAP accounts checked-in table to display hierarchical LDAP libraries
* ui: Update LDAP library count to reflect the total number of nodes instead of number of directories
## 1.21.0
### October 22, 2025
SECURITY:
* auth/aws: fix an issue where a user may be able to bypass authentication to Vault due to incorrect caching of the AWS client
* auth/ldap: fix MFA/TOTP enforcement bypass when username_as_alias is enabled.
* core: Update github.com/hashicorp/go-getter to fix security vulnerability GHSA-wjrx-6529-hcj3.
* core: Update github.com/ulikunitz/xz to fix security vulnerability GHSA-25xm-hr59-7c27.
* ui: disable scarf analytics for ui builds
CHANGES:
* Secrets Recovery (enterprise): Deprecate the `recover_snapshot_id` query parameter to pass the snapshot ID for recover operations, in favor of a `X-Vault-Recover-Snapshot-Id` header. Vault will still accept the query parameter for backward compatibility. Also support setting the HTTP method to `RECOVER` for recover operations, in addition to `POST` and `PUT`.
* activity: Renamed `timestamp` in export API response to `token_creation_time`.
* auth/alicloud: Update plugin to [v0.22.0](https://github.com/hashicorp/vault-plugin-auth-alicloud/releases/tag/v0.22.0)
* auth/azure: Update plugin to [v0.22.0](https://github.com/hashicorp/vault-plugin-auth-azure/releases/tag/v0.22.0)
* auth/cf: Update plugin to [v0.22.0](https://github.com/hashicorp/vault-plugin-auth-cf/releases/tag/v0.22.0)
* auth/gcp: Update plugin to [v0.22.0](https://github.com/hashicorp/vault-plugin-auth-gcp/releases/tag/v0.22.0)
* auth/jwt: Update plugin to [v0.25.0](https://github.com/hashicorp/vault-plugin-auth-jwt/releases/tag/v0.25.0)
* auth/kerberos: Update plugin to [v0.16.0](https://github.com/hashicorp/vault-plugin-auth-kerberos/releases/tag/v0.16.0)
* auth/kubernetes: Update plugin to [v0.23.0](https://github.com/hashicorp/vault-plugin-auth-kubernetes/releases/tag/v0.23.0)
* auth/oci: Update plugin to [v0.20.0](https://github.com/hashicorp/vault-plugin-auth-oci/releases/tag/v0.20.0)
* auth/saml: Update plugin to [v0.7.0](https://github.com/hashicorp/vault-plugin-auth-saml/releases/tag/v0.7.0)
* core: Updates post-install script to print updated license information
* database/couchbase: Update plugin to [v0.15.0](https://github.com/hashicorp/vault-plugin-database-couchbase/releases/tag/v0.15.0)
* database/elasticsearch: Update plugin to [v0.19.0](https://github.com/hashicorp/vault-plugin-database-elasticsearch/releases/tag/v0.19.0)
* database/mongodbatlas: Update plugin to [v0.16.0](https://github.com/hashicorp/vault-plugin-database-mongodbatlas/releases/tag/v0.16.0)
* database/redis-elasticache: Update plugin to [v0.8.0](https://github.com/hashicorp/vault-plugin-database-redis-elasticache/releases/tag/v0.8.0)
* database/redis: Update plugin to [v0.7.0](https://github.com/hashicorp/vault-plugin-database-redis/releases/tag/v0.7.0)
* database/snowflake: Update plugin to [v0.15.0](https://github.com/hashicorp/vault-plugin-database-snowflake/releases/tag/v0.15.0)
* http: Add JSON configurable limits to HTTP handling for JSON payloads: `max_json_depth`, `max_json_string_value_length`, `max_json_object_entry_count`, `max_json_array_element_count`.
* http: Evaluate rate limit quotas before checking JSON limits during request handling.
* policies: change list comparison to allowed_parameters and denied_parameters from "exact match" to "contains all"
* sdk: Upgrade to go-secure-stdlib/plugincontainer@v0.4.2, which also bumps github.com/docker/docker to v28.3.3+incompatible
* secrets/alicloud: Update plugin to [v0.21.0](https://github.com/hashicorp/vault-plugin-secrets-alicloud/releases/tag/v0.21.0)
* secrets/azure: Update azure enterprise secrets plugin to include static roles.
* secrets/azure: Update plugin to [v0.23.0](https://github.com/hashicorp/vault-plugin-secrets-azure/releases/tag/v0.23.0)
* secrets/gcp: Update plugin to [v0.23.0](https://github.com/hashicorp/vault-plugin-secrets-gcp/releases/tag/v0.23.0)
* secrets/kubernetes: Update plugin to [v0.12.0](https://github.com/hashicorp/vault-plugin-secrets-kubernetes/releases/tag/v0.12.0)
* secrets/kv: Update plugin to [v0.25.0](https://github.com/hashicorp/vault-plugin-secrets-kv/releases/tag/v0.25.0)
* secrets/mongodbatlas: Update plugin to [v0.16.0](https://github.com/hashicorp/vault-plugin-secrets-mongodbatlas/releases/tag/v0.16.0)
* secrets/openldap: Update plugin to [v0.17.0](https://github.com/hashicorp/vault-plugin-secrets-openldap/releases/tag/v0.17.0)
* secrets/terraform: Update plugin to [v0.13.0](https://github.com/hashicorp/vault-plugin-secrets-terraform/releases/tag/v0.13.0)
* ui/client-counts: removes tabs for each client count type and adds split view for counts per type in overview stacked bar chart
* ui: Add client count attribution for the full billing period to the client counts overview table
* ui: Remove namespace context filter for activity in client count dashboard
FEATURES:
* **AES-CBC in Transit** (Enterprise): Add support for encryption and decryption with AES-CBC in the Transit Secrets Engine.
* **KV v2 Version Attribution**: Vault now includes attribution metadata for
versioned KV secrets. This allows lookup of attribution information for each
version of KV v2 secrets from CLI and API.
* **Login MFA TOTP Self-Enrollment (Enterprise)**: Simplify creation of login MFA TOTP credentials for users, allowing them to self-enroll MFA TOTP using a QR code (TOTP secret) generated during login. The new functionality is configurable on the TOTP login MFA method configuration screen and via the `enable_self_enrollment` parameter in the API.
* **Plugin Downloads**: Support automatically downloading official HashiCorp secret and auth plugins from releases.hashicorp.com (beta)
* **Post-Quantum Cryptography Support**: Experimental support for PQC signatures with ML-DSA in Transit.
* **Post-Quantum Cryptography Support**: Experimental support for PQC signatures with SLH-DSA in Transit.
* **SPIFFE Authentication Plugin (enterprise)**: Add support to authenticate to Vault using JWT and x509 based SPIFFE IDs.
* **SSH Key Signing Improvements ** (Enterprise): Add support for using managed keys to sign SSH keys in the SSH secrets engine.
* **Secret Recovery from Snapshot (enterprise)**: Adds a framework to load an integrated storage snapshot into Vault and read, list, and recover KV v1 and cubbyhole secrets from the snapshot.
* **UI Client List Explorer (Enterprise)**: Adds ability to view and filter client IDs and metadata by namespace, mount path, or mount type for a billing period.
* **UI Secrets Recovery (Enterprise)**: Allows end users to recover single KV v1 secrets, Cubbyhole secrets, or Database static roles from a loaded snapshot if the secrets were changed or deleted in error. Automatic snapshot configurations can now automatically load the snapshot to Vault itself, making it available for recovery. Snapshot management permissions are separated from recovery permissions so that recovery operations can be delegated but controlled.
* **UI: Secret Engine Tune Support**: Add support for updating secret engine mount configuration via the Tune endpoint
* **Vault PKI SCEP Server (Enterprise)**: Support for the Simple Certificate Enrollment Protocol (SCEP) has been added to the Vault PKI Plugin. This allows standard SCEP clients to request certificates from a Vault server with no knowledge of Vault APIs.
IMPROVEMENTS:
* ui/activity: Updates running total stats to be displayed via a donut chart.
* Plugin Downloads (enterprise): add CLI `-download` option for plugin register (beta)
* Raft: Auto-join will now allow you to enforce IPv4 on networks that allow IPv6 and dual-stack enablement, which is on by default in certain regions.
* Secrets Recovery (enterprise): Support recovering items from a snapshot to a new path in the live cluster. By calling the `vault recover` command with a `-from` flag, users can specify the path of the item in the snapshot.
* Secrets Sync (enterprise): add `enterprise_url` field to enable support for self-hosted GitHub Enterprise Server instances.
* activity (enterprise): Add a cumulative namespace client count API at `sys/internal/counters/activity/cumulative`. For each namespace in the response it returns the sum of its own client counts and that of all its child namespaces.
* activity: The [activity export API](https://developer.hashicorp.com/vault/api-docs/system/internal-counters#activity-export) response now includes a new timestamp that denotes the first time the client was used within the specified query period.
* api (sys/utilization-report): Added namespace filter and more granularity for secret sync data in the response.
* api: Add new logical client request interfaces for read, write, delete, list operations.
* audit: Add additional verifications to the target of file audit sinks.
* auth/approle (enterprise): Add ability to specify custom alias metadata via new role creation parameter `alias_metadata`.
* auth/aws (enterprise): Add ability to specify custom alias metadata via new role creation parameter `alias_metadata`.
* auth/cert (enterprise): Add ability to specify custom alias metadata via new CA certificate role creation parameter `alias_metadata`.
* auth/cert: Add allowed_organizations support
* auth/cert: Support RFC 9440 colon-wrapped Base64 certificates in `x_forwarded_for_client_cert_header`, to fix TLS certificate auth errors with Google Cloud Application Load Balancer.
* auth/cert: test non-CA cert equality on login matching instead of individual fields.
* auth/github (enterprise): Add ability to specify custom alias metadata via new configuration parameter `alias_metadata`.
* auth/ldap (enterprise): Add ability to specify custom alias metadata via new role configuration parameter `alias_metadata`.
* auth/ldap: Introduces an option to connect to an alternative LDAP URL for root credential rotation, in cases where it differs from the configured LDAP URL.
* auth/ldap: add explicit logging to rotations in ldap
* auth/okta (enterprise): Add ability to specify custom alias metadata via new role configuration parameter `alias_metadata`.
* auth/radius (enterprise): Add ability to specify custom alias metadata via new role configuration parameter `alias_metadata`.
* auth/scep (enterprise): Add ability to specify custom alias metadata via new role creation parameter `alias_metadata`.
* auth/userpass (enterprise): Add ability to specify custom alias metadata via new user creation parameter `alias_metadata`.
* cli (enterprise): Add a `-force` flag to `vault operator raft snapshot unload` command to force deletion of a loaded snapshot.
* core (enterprise): Allow setting of an entropy source on password generation
policies, and with it the selection of "seal" to use entropy augmentation.
* core (enterprise): add ability to get time remaining until rotation from rotation manager
* core (enterprise): add support for new pki-only license feature
* core (enterprise): improve rotation manager logging to include specific lines for rotation success and failure
* core/metrics: Reading and listing from a snapshot are now tracked via the `vault.route.read-snapshot.{mount_point}` and `vault.route.list-snapshot.{mount_point}` metrics.
* core/snapshot-load (enterprise): Add a `force` query parameter to the `DELETE sys/storage/raft/snapshot-load/{snapshot_id}` endpoint to allow for forced deletion of snapshots. This is useful when the snapshot is in a state that prevents normal deletion, such as being in the process of loading.
* license utilization reporting (enterprise): Add metrics for the number of issued PKI certificates.
* openapi: Add OpenAPI support for secret recovery operations.
* openapi: Add openapi response definitions to `sys/internal/counters/activity/*` endpoints.
* plugins: Clarify usage of sha256, command, and version for plugin registration of binary or artifact with API and CLI. Introduce new RegisterPluginDetailed and RegisterPluginWtihContextDetailed functions to API client to propagate response along with error, and mark RegisterPlugin and RegisterPluginWithContext as deprecated.
* proxy/cache (enterprise): Vault Proxy will now use vault_index on events to be able to update cached static secrets from performance secondaries without needing to be forwarded. This will take precedence over attempting to forward the request to the primary.
* sdk: add stub code for retrieving rotation schedule information
* secrets/database (enterprise): Add support for reading, listing, and recovering static roles from a loaded snapshot. Also add support for reading static credentials from a loaded snapshot.
* secrets/database: Add PSC support for GCP CloudSQL MySQL and Postgresql
* secrets/database: Add PrivateIP support for MySQL
* secrets/database: Add root rotation support for Snowflake database secrets engines using key-pair credentials.
* secrets/database: log password rotation success (info) and failure (error). Some relevant log lines have been updated to include "path" fields.
* secrets/kmip (enterprise): Update various third party dependencies.
* secrets/pki (enterprise): add integrations/guardium configuration endpoint.
* secrets/pki (enterprise): add new batch/certs endpoint to allow multiple certificates to be fetched at once.
* secrets/pki (enterprise): enable separately-configured logging for SCEP-enrollment.
* secrets/pki: Add the digest OID when logging SCEP digest mismatch errors.
* secrets/ssh: Add support for recovering the SSH plugin CA from a loaded snapshot (enterprise only).
* secrets/transform (enterprise): Update various third party dependencies.
* secrets/transit: add logging on both success and failure of key rotation
* storage/raft (enterprise): Add `autoload_enabled` option to raft automated snapshot configurations. When enabled, this option will automatically load raft snapshots into Vault, which can then be used for recovery operations.
* sys (enterprise): Add sys/billing/certificates API endpoint to retrieve the number of issued PKI certificates.
* ui/activity (enterprise): Add clarifying text to explain the "Initial Usage" column will only have timestamps for clients initially used after upgrading to version 1.21
* ui/activity (enterprise): Reduce requests to the activity export API by only fetching new data when the dashboard initially loads or is manually refreshed.
* ui/activity (enterprise): Support filtering months dropdown by ISO timestamp or display value.
* ui/activity: Adds filtering by month to the Client Count dashboard to link client counts to specific client IDs from the export API
* ui/auth: the role field on the OIDC login form now auto-fills from the `role` URL query string parameter
* ui/auth: the role field on the SAML login form now auto-fills from the `role` URL query string parameter
* ui/secrets: Display the plugin version on the secret engine list view. Move KV's version to a tooltip that appears when hovering over the engine's name.
* ui/secrets: Updated filters on secret engines list to sort by path, engine type and version
* ui: Add `namespace_path`, `mount_path` and `mount_type` filters to attribution table
* ui: Enhanced secret engine selection dynamically displays all available plugins from the plugin catalog.
* ui: Format multiline API error messages to render as bulleted lists.
* ui: Use the Helios Design System Code Block component for all readonly code editors and use its Code Editor component for all other code editors
DEPRECATIONS:
* core: disallow usage of duplicate attributes in HCL configuration files and policy definitions, which were already deprecated. For now those errors can be suppressed back to warnings by setting the environment variable VAULT_ALLOW_PENDING_REMOVAL_DUPLICATE_HCL_ATTRIBUTES.
BUG FIXES:
* activity (enterprise): Fix `development_cluster` setting being overwritten on performance secondaries upon cluster reload.
* activity (enterprise): sys/internal/counters/activity outputs the correct mount type when called from a non root namespace
* agent/template: Fixed issue where templates would not render correctly if namespaces was provided by config, and the namespace and mount path of the secret were the same.
* auth/approle (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth/aws (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth/cert (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth/cert: Recover from partially populated caches of trusted certificates if one or more certificates fails to load.
* auth/github (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth/ldap (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth/okta (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth/radius (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth/scep (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth/scep (enterprise): enforce the token_bound_cidrs role parameter within SCEP roles
* auth/spiffe: Address an issue updating a role with overlapping workload_id_pattern values it previously contained.
* auth/userpass (enterprise): Role parameter `alias_metadata` now populates alias custom metadata field instead of alias metadata.
* auth: fixed panic when supplying integer as a lease_id in renewal.
* auth: update alias lookahead to respect username case for LDAP and username/password
* auto-reporting (enterprise): Clarify debug logs to accurately reflect when automated license utilization reporting is enabled or disabled, especially since manual reporting is always initialized.
* core (enterprise): Avoid duplicate seal rewrapping, and ensure that cluster secondaries rewrap after a seal migration.
* core (enterprise): fix a bug where issuing a token in a namespace used root auth configuration instead of namespace auth configuration
* core/activitylog (enterprise): Fix nil panic when trying reload census manager before activity log is setup.
* core/metrics: Add service name prefix for core HA metrics to avoid duplicate, zero-value metrics.
* core/seal (enterprise): Fix a bug that caused the seal rewrap process to abort in the presence of partially sealed entries.
* core/seal: When Seal-HA is enabled, make it an error to persist the barrier keyring when not all seals are healthy. This prevents the possibility of failing to unseal when a different subset of seals are healthy than were healthy at last write.
* core: Fixed issue where under certain circumstances the rotation manager would spawn goroutines indefinitely.
* core: Role based quotas now work for cert auth
* core: interpret all new rotation manager rotation_schedules as UTC to avoid inadvertent use of tz-local
* core: resultant-acl now merges segment-wildcard (`+`) paths with existing prefix rules in `glob_paths`, so clients receive a complete view of glob-style permissions. This unblocks UI sidebar navigation checks and namespace access banners.
* default-auth: Fix bug where listing default-auth configurations caused panic during auditing.
* gcs: fix failed locking due to updated library error checks
* identity/mfa: revert cache entry change from #31217 and document cache entry values
* kmip (enterprise): Fix a panic that can happen when a KMIP client makes a request before the Vault server has finished unsealing.
* mongodb: fix mongodb connection issue when using TLS client + username/password authentication
* plugins: Fix panics that can occur when a plugin audits a request or response before the Vault server has finished unsealing.
* product usage reporting (enterprise): Clarify debug logs to accurately reflect when anonymous product usage reporting is enabled or disabled, especially since manual reporting is always initialized.
* raft (enterprise): auto-join will now work in regions that do not support dual-stack
* raft/autopilot: Fixes an issue with enterprise redundancy zones where, if the leader was in a redundancy zone and that leader becomes unavailable, the node would become an unzoned voter. This can artificially inflate the required number of nodes for quorum, leading to a situation where the cluster cannot recover if another leader subsequently becomes unavailable. Vault will now keep an unavailable node in its last known redundancy zone as a non-voter.
* replication (enterprise): Fix bug where group updates fail when processed on a standby node in a PR secondary cluster.
* replication (enterprise): Fix bug with mount invalidations consuming excessive memory.
* secrets-sync (enterprise): GCP locational KMS keys are no longer incorrectly removed when the location name is all lowercase.
* secrets-sync (enterprise): Unsyncing secret-key granularity associations will no longer give a misleading error about a failed unsync operation that did indeed succeed.
* secrets/azure: Ensure proper installation of the Azure enterprise secrets plugin.
* secrets/database/postgresql: Support for multiline statements in the `rotation_statements` field.
* secrets/database: respect the escaping/disable_escaping state when using self-managed static roles
* secrets/transit: Fix error when using ed25519 keys that were imported with derivation enabled
* sentinel (enterprise): Fix a Sentinel bug, where the soft-mandatory policy override would not work in overriding request denial. Now, Vault correctly allows requests when the policy override flag is set. Previously, requests were denied even if an override was explicitly set. Error messaging for denied requests is now clearer and more actionable.
* sys/mounts: enable unsetting allowed_response_headers
* ui (enterprise): Fixes login form so input renders correctly when token is a preferred login method for a namespace.
* ui: Fix DR secondary view from not loading/transitioning.
* ui: Fix kv v2 overview page from erroring if a user does not have access to the /subkeys endpoint and the policy check fails.
* ui: Fix page loading error when users navigate away from identity entities and groups list views.
* ui: Fix regression in 1.20.0 to properly set namespace context for capabilities checks
* ui: Fix selecting multiple namespaces in the namespace picker when the path contains matching nodes
* ui: Fixes UI login settings list page which was not rendering rules with an underscore in the name.
* ui: Include user's root namespace in the namespace picker if it's a namespace other than the actual root ("")
* ui: Revert camelizing of parameters returned from `sys/internal/ui/mounts` so mount paths match serve value
* ui: Fixes permissions for hiding and showing sidebar navigation items for policies that include special characters: `+`, `*`
## 1.20.17 Enterprise
### October 07, 2026
BREAKING CHANGES:
* pki: ACME finalization with the default `sign-verbatim` directory policy now rejects CSRs that contain URI SANs, email SANs, or Other SANs. ACME challenges only verify DNS names and IP addresses; those SAN types are never validated and must not appear in issued certificates. Operators who require the previous behaviour can set `default_directory_policy = "sign-verbatim-unsafe"` in `config/acme`, accepting that the resulting certificates may contain unverified identity claims.
SECURITY:
* core (enterprise): Prevent policy-name canonicalization bypasses in ACL parameter restrictions.
* core/plugin: Fix plugin catalog entries restored from a raft snapshot, written through `sys/raw`, or replicated being able to run a binary outside `plugin_directory`.
* core/policy: Harden request-time ACL construction to ignore malformed legacy policy references containing path-navigation segments (`.` or `..`) so traversal-style names are never resolved or applied.
* core: Fixed a bypass of exact-deny ACL policies where case-variant AppRole, AWS, Azure, GCP, Kubernetes, SCEP, or TPM role names, GitHub team or user policy mapping keys, certificate or CRL names, ACL/RGP/EGP policy names, or userpass usernames could evade the deny and be resolved by the backend to the same protected resource. Okta group names, LDAP and RADIUS names on mounts left in their default case-insensitive configuration, and Enterprise SCIM client names (`identity/scim/client/<name>`, where a case-variant write overwrites the existing client) are not covered by this fix and remain subject to the same bypass; avoid combining a wildcard allow with an exact deny on those mounts and paths.
CHANGES:
* core/plugin: Plugin catalog entries are now checked against `plugin_directory` whenever they are used, not only at registration. An entry whose command resolves outside the directory, including through a symlink, is refused with `plugin command is outside of configured plugin directory`, and mounts that use it are skipped at startup while keeping their data. Such plugins must be registered again with their binary inside `plugin_directory`.
* core/policy: Vault now validates policy names with segment-aware checks. Empty names and names containing `.` or `..` path segments are rejected for new policy writes and assignments, while names containing `/` and `\` remain supported. During request-time ACL construction, legacy traversal-style policy references are not applied (treated as invalid and unresolved), which can reduce effective token permissions. Operators should audit and rename affected policies before upgrading.
* core: ACL and Sentinel EGP rule paths targeting a specific AppRole, AWS, Azure, GCP, Kubernetes, SCEP, or TPM role, GitHub team or user policy mapping key, certificate or CRL name, ACL/RGP/EGP policy name, or userpass username are now matched against the lowercased resource name, since these backends resolve those names case-insensitively. A rule written with a mixed-case resource name (for example `auth/approle/role/MyRole`) no longer matches requests for that resource and must be rewritten using the lowercase name (`auth/approle/role/myrole`). The lowercased form is also what Sentinel RGP and EGP policies observe as `request.path`, so policy rules that compare that value against a mixed-case path (for example `request.path is "auth/approle/role/MyRole"`) must be updated as well. External auth and secret plugins are not affected by this normalization and continue to receive requests with their original casing. Existing deny rules using mixed-case resource names will fail open (become allow-all) after upgrade until rewritten with lowercase names.
* ui: Remove HCP Link status indicator following deprecation of HCP Link.
IMPROVEMENTS:
* token: Add debug logging for foreign server side consistent token handling
* ui: Remove unused Vercel Storybook artifacts (`vercel.json`, `metadata.json`) left over from the Storybook removal in 2022
* ui: Upgrade Path Analyzer selects latest available version by default and shows state message when the user is already up-to-date.
* ui: Upgrade Path Analyzer surfaces API errors
BUG FIXES:
* identity/entity: Fixed an issue where the `from_entity`'s entity aliases were not properly deleted during entity merges.
* identity: Fix duplicate member_entity_ids entries in external groups when a JWT/OIDC login token carries repeated group-name entries in the groups claim.
* secrets-sync (enterprise): Fix destinations configured with `allowed_ipv4_addresses` or `allowed_ipv6_addresses` failing with `INTERNAL_VAULT_ERROR` after a leadership change, until the destination configuration was reapplied.
* secrets/database (enterprise): Fix cleanup of database plugin sub processes and resources when initialization of the database connection fails.
* secrets/database: Fix missing-credentials error for Database types without self-managed support incorrectly suggesting the self-managed option.
* secrets/transit: fix CSR re-signing to preserve extension Critical flags and prevent malformed ASN.1 output when Subject Alternative Names and extra extensions are both present
## 1.20.16 Enterprise
### September 16, 2026
SECURITY:
* core: Update github.com/apache/thrift to v0.24.0 to fix security vulnerability ghsa-8wv5-x4w7-5gww.
* core: Update golang.org/x/crypto to v0.56.0 to fix security vulnerabilities GO-2026-6354 and GO-2026-6355.
* core: Update google.golang.org/grpc to v1.83.2 to fix security vulnerability GHSA-2v4p-qf9q-27wj.
CHANGES:
* core: Bump Go version to 1.26.8.
IMPROVEMENTS:
* core: Add a `ui_settings` configuration stanza with a `ui_telemetry` option, surfaced to the UI via the `sys/internal/ui/settings` endpoint, that gates anonymous UI usage telemetry.
* secrets/pki: add an additional field to include a RFC 5280 revocation reason for (/pki/revoke) and (/pki/revoke-with-key).
* ui: Add pnpm.overrides entry for markdown-it (14.1.1) to fix security vulnerability SECVULN-37952.
* ui: Bump dompurify to 3.4.15 to address SECVULN advisories
BUG FIXES:
* auth/approle: Fix `token_bound_cidrs` validation when using /128 blocks for role and secret ID
* core/mounts: Fixed `vault secrets move` (and `vault auth move`) incorrectly placing a mount in the root namespace when the destination path has a leading slash.
* plugins: Fix issue with `vault plugin reload -mounts` command when run in the root namespace
* secrets-sync (enterprise): Fix `LIST /v1/sys/sync/associations` intermittently returning zero associations/secrets by forwarding the request to the active node instead of allowing it to be served locally by a performance standby or performance secondary.
* secrets/pki (enterprise): Fix panic in CMPv2 sentinel field parsing when cert request messages is empty.
## 1.20.15 Enterprise
### September 01, 2026
SECURITY:
* core: Update go.etcd.io/etcd/client/pkg/v3 to v3.6.14 to fix security vulnerability GO-2026-6107.
CHANGES:
* core/raft: Limited concurrent retry-join workers to 20. Any further retry-join attempts while 20 are in progress will result in an error (`too many concurrent raft retry joins in progress`).
* core: Bump Go version to 1.25.14.
IMPROVEMENTS:
* core/seal (enterprise): Update Oracle Cloud library to enable seal integration with newer regions.
* core: Automatically write a goroutine dump to a temp directory on shutdown (SIGTERM/SIGINT). The output directory can be overridden with `VAULT_STACKTRACE_FILE_PATH`, and the dump can be suppressed with the config field `disable_goroutine_trace_dump`.
* ui: Exposing the RSA Private Key field in the UI when generating credentials with the snowflake database secrets engine. Previously, this field was only shown in the cli.
BUG FIXES:
* api: Account for the HTTP Age header when calculating a lease's remaining lifetime, so that leases read or renewed through a caching proxy such as Vault Agent are renewed before they expire.
* core (enterprise): Fix a data race and potential panic during seal/unseal
* core (enterprise): Fix a data race and potential panic during seal/unseal
* core (enterprise): Fix panic in `collectOperatorImportMetrics` when `router.Route` returns a nil response with no error during KVv2 metadata reads on performance secondary nodes. This condition occurs during the WAL-stream partial-sync phase of an initial join.
* core/login: Fix panic on malformed login requests. Vault now returns an error for malformed login payloads instead of dropping the client connection (no data loss).
* core/metrics: Fixed a bug where log_format = "json" had no effect on telemetry sink errors from statsd and statsite backends.
* core/wrapping: sys/wrapping/wrap now enforces uuid-format wrapping tokens, ignoring any caller-requested wrap format.
* core: Fix `vault operator migrate -start` command when migrating to raft integrated storage.
* core: Standby clusters now populate the `cluster:` field when `sys/metrics` is called.
* default-auth: Fix issue with legacy default-auth configs that would break as part of upgrading to a newer version of Vault.
* plugins: Reading a versioned-only plugin without specifying `-version` now auto-selects it when only one version exists, or returns an error listing available versions, instead of a silent 404.
* secret/pki: Fix ACME order finalize race condition where concurrent requests could double-issue certificates and orphan one from order-keyed tracking
* secret/pki: prevent key rename from accepting a name already held by a different key.
* secrets/database: Sanitize the caller-controlled DisplayName before it is used in generated usernames to prevent SQL injection via username templates. Adds a configuration warning when a username_template references DisplayName without a truncate function.
* serviceregistration/consul: Fixed an issue where Vault would permanently deregister itself from the Consul service catalog when a SIGHUP/reload signal was sent and the configuration used Consul as the storage backend without an explicit `service_registration` stanza.
* ui: Fix open redirect bug in OIDC provider route.
* ui: add totalItems property to fix filtered list pagination showing incorrect total page count
* ui: fix spurious "No access" banner when navigating to Vault UI with `?namespace=root` in the URL
## 1.20.14 Enterprise
### August 04, 2026
BREAKING CHANGES:
* containers: The following packages have been removed from UBI based container
images: gnupg, openssl, procps.
SECURITY:
* acl: Fix privilege-escalation vulnerability where a `denied_parameters` constraint on the `policies` request field could be bypassed by submitting a mixed-case policy name (e.g. "Super-Admin" instead of "super-admin"). Vault now normalizes the `policies` parameter to lowercase before evaluating `allowed_parameters`/`denied_parameters` constraints.
* identity: Prevent the entity batch-delete endpoint (identity/entity/batch-delete) from deleting the underlying storage of entities that belong to another namespace.
* identity: entity/name updates now reject mismatched id or external_id selectors to prevent retargeting updates to a different entity
CHANGES:
* auth/oci: Update plugin to [v0.19.3](https://github.com/hashicorp/vault-plugin-auth-oci/releases/tag/v0.19.3)
* core: Bump Go version to 1.25.12.
IMPROVEMENTS:
* auth/cert: Support login via x-forwarded cert headers even with tls disabled on the vault listener.
* core (entreprise): Ameriolate sealwrap lock contention for core paths.
* core/acl: Adds a global `deny_slash_in_templated_path` configuration option to reject the presence of slashes in rendered identity templates in policies, defaulting to `false`.
* core/identity: Adds a global `deny_slash_in_templated_path` configuration option to reject the presence of slashes in rendered identity templates in policies, defaulting to `false`.
* core/managed-keys/PKCS#11 (enterprise): Providing a non-empty value for one field while the other is already saved is rejected. To switch addressing modes, you must explicitly clear the old field by sending it as an empty string ("") in the same request alongside the new value.
* core/managed-keys/PKCS#11 (enterprise): slot and token_label are now strictly enforced as mutually exclusive identifiers for an HSM token
* events: Add `VAULT_EVENT_NOTIFICATIONS_BOUNDED_QUEUE_SIZE` environment variable to configure bounded event queues for event notification subscribers. Set to a positive integer (e.g., 16) to enable buffered channels of that size (maximum 1000). This prevents resource exhaustion in deployments with high subscriber counts, but comes at the cost of the potential for subscribers to miss events. Defaults to 0 (unbuffered) for backward compatibility.
BUG FIXES:
* Proxy/Agent: Fixed a bug where auth method headers accumulated on the shared API client across re-auth cycles.
* Proxy: Fixed a bug where the Vault token header accumulated duplicate values across WebSocket reconnects in the static secret cache updater.
* Secrets Recovery (enterprise): Do not redirect to the active node for list requests to `sys/storage/raft/snapshot-load` or read/delete requests to `sys/storage/raft/snapshot-load/{id}`. If possible, handle these requests on the performance standby, otherwise forward the requests to the active node.
* audit: Fix a regression from CVE-2025-6000 that broke enabling audit devices on Windows when a plugin directory was configured.
* audit: make file and socket audit sink serialization context-aware so canceled or expired requests stop waiting behind blocked audit writes, reducing buildup of goroutines, memory, connections, and file descriptors during audit sink contention
* auth/cert: Add support for x-forwarded cert headers coming from AWS ALBs.
* aws/auth: Redact EC2 instance metadata values from AWS auth error messages.
* core (enterprise): Fix a bug that causes unnecessary seal rewrapping.
* core (enterprise): Preserve wrapping metadata when Control Group unwrap replays an approved request that returns a wrapped response.
* core (enterprise): Update state checking of Sever-Side Consistent Token (SSCT) when used on performance secondary clusters. 403 response codes will be preferred over 412 for invalid, cross cluster token requests to secondary active nodes.
* core/managed-keys (enterprise): Allow slot numbers above 32 bits in PKCS#11 managed keys.
* core/seal: Fixed goroutine leak occurring when Encryption and Decryption functions time out.
* core: Preserve URL query parameters when redirecting API requests containing duplicate slashes to their canonical path.
Previously, the redirect dropped parameters such as `?list=true`, potentially changing the result of the request.
* export API: Normalize the end_time parameter in the activity export API to the end of the month to match the behavior stated in the documentation.
* secrets-sync: Fix GCP Secret Manager destinations losing their per-region KMS key on Vault restart.
* secrets-sync: Fixes Custom Tags field in Details view to display keys with empty value
* secrets/transit (enterprise): Add managed key support to CSR sign and set certificate chain endpoints.
* secrets/transit: Add managed key support to Transit rewrap endpoint.
* ui: Correctly handle string values ("true"/"false") for `tls_disable` when displaying TLS status in the Cluster Configuration widget.
## 1.20.13 Enterprise
### June 17, 2026
SECURITY:
* auth/radius: Added case_insensitive_names toggle to prevent username collisions and enable case-insensitive user handling.
* core/acl: Fix LIST ACL bypass where a trailing-slash request could skip a more-specific deny rule.
* core: Use constant-time recovery token comparison
CHANGES:
* auth/cf: Update plugin to [v0.21.1](https://github.com/hashicorp/vault-plugin-auth-cf/releases/tag/v0.21.1)
* core/acl: LIST requests with a trailing slash now correctly respect more-specific deny policies. Previously, a deny on `path "kv/*" { deny }` could be bypassed for `LIST kv/private/` if a broader allow `path "kv/*"` also existed. Policies relying on the previous (incorrect) behavior may now be denied.
* core: Vault will now redirect non-canonicalized paths (containing `/./`, `/../`, or `//`) to a cleaned path, instead of rejecting these requests
IMPROVEMENTS:
* secrets/azure: For dynamic apps, Vault now creates the app and its client secret with a single MS Graph API request, significantly reducing temporary errors caused by Azure eventual consistency
* core (Enterprise): Make deadlock detection in sealwrap configurable by adding "sealwrap" to existing configuration detect_deadlocks.
* ui (enterprise): Migrate charts from Lineal to Carbon Charts in the Client usage overview and Vault usage dashboard.
BUG FIXES:
* core/rotationMgr: Fix storage routing for local mounts in namespaces to prevent metadata replication and ensure GDPR compliance.
* secret-sync (enterprise): Fix GCP Secret Manager replication policy persistence across Vault restarts.
* secrets/database/mssql: Deregister stale TLS configurations when MySQL connection TLS settings change or the connection is closed, preventing retained certificate pools from accumulating.
* secrets/pki: Fix PKI certificate issuance not_after time to respect max TTL.
* storage/raft: reject `performance_multiplier` values less than or equal to zero
## 1.20.12 Enterprise
### June 05, 2026
BREAKING CHANGES:
* containers: Remove `cap_ipc_lock` capability on `vault` at build time to allow running Vault in common container runtimes. Vault in containers will no longer be able to call `mlock()` to lock memory. Operators should set `disable_mlock = true` in Vault's configuration. Runtime operators are advised to disable swapping to guarantee data safety.
* secrets/ssh: RSA key sizes are now limited to a maximum size of 8192 bits addressing CVE-2026-39829
CHANGES:
* core: Bump Go version to 1.25.11
BUG FIXES:
* plugins: Fix plugin signature verification failure with expired pgp key when registering a plugin.
* secret-sync (enterprise): Fix a panic when creating Secrets Sync destinations if `fetch_identity_token` callback fields are present in store configuration.
## 1.20.11 Enterprise
### May 19, 2026
BREAKING CHANGES:
* containers: set cap_ipc_lock capability on vault at build time. Container runtimes will need to add `IPC_LOCK` capabilities when running the vault container.
SECURITY:
* api: Update golang.org/x/net to resolve GO-2026-4918"
* core/identity: reject wildcards in rendered identity templates
* core: Resolve GHSA-j88v-2chj-qfwx by removing our dependency on github.com/jackc/pgx/v3 and github.com/jackc/pgx/v4
* core: Update github.com/Azure/go-ntlmssp to fix security vulnerability v0.1.1.
* core: Update github.com/apache/thrift to fix security vulnerability GHSA-wf45-q9ch-q8gh
* core: Update github.com/jackc/pgx/v5 to fix security vulnerability GHSA-j88v-2chj-qfwx.
* core: Update golang.org/x/net to resolve GO-2026-4918"
* core: Validate both `path` and `file_path` cannot be empty for requests to `sys/audit/{path}`
* sdk: Resolve GHSA-j88v-2chj-qfwx by removing our dependency on github.com/jackc/pgx/v3 and github.com/jackc/pgx/v4
* sdk: Update github.com/Azure/go-ntlmssp to fix security vulnerability v0.1.1.
* sdk: Update github.com/jackc/pgx/v5 to fix security vulnerability GHSA-j88v-2chj-qfwx.
* sdk: Update golang.org/x/net to resolve GO-2026-4918"
CHANGES:
* auth/jwt: Update plugin to [v0.24.2](https://github.com/hashicorp/vault-plugin-auth-jwt/releases/tag/v0.24.2)
* core: Bump Go version to 1.25.10
* identity: Require `sudo` capability to invoke the identity entity merge API endpoint (`identity/entity/merge`).
IMPROVEMENTS:
* api: Add migration_done_at_epoch to sys/seal-status response.
* core (Enterprise): Sanitized config now shows kms_library config.
* core/seal (enterprise): Make it possible for new nodes to join a cluster configured with Seal High Availability.
* sdk: Expand support for docker test cluster options like seals, kms libraries, and entropy augmentation. DockerClusterNode.UpdateConfig now takes a full set of cluster options instead of just node config.
* secrets/pki (enterprise): Allow SCEP to use an issuer that is backed by an RSA based PKCS#11 managed key
* ui: `unsafe-inline` is no longer included in the `style-src` CSP directive.
BUG FIXES:
* client/ocsp: Adds a grace period to renew the cached entry for OCSP response.
* core: Fix failure to detect errors during storage writes of totp keys.
* database/mssql: Fix "sysadmin" requirement during lease revocation by replacing the undocumented `sp_msloginmappings` procedure with a granular metadata query. This allows the plugin to function with `VIEW ANY DEFINITION` instead of full `sysadmin` privileges.
* database/mssql: Fix dynamic secret revocation by executing custom statements as a single batch instead of splitting on semicolons
* database/snowflake: Fix WAL rollback issue for key-pair root credential rotation.
* database: prevent static role rotation and connection init from hanging indefinitely when database calls block by adding timeouts around UpdateUser and Initialize
* go-plugin: Upgrade go-plugin to fix a bug where file descriptors could be leaked when spawning external plugins
* identity: fixed a rare but possible data race issue with identities.
* plugins/database/hana: Fixed a SQL injection risk in the default DeleteUser revoke path by safely quoting usernames as SQL identifiers before ALTER USER and DROP USER statements.
plugins/database/redshift: Fixed a SQL injection risk in the default DeleteUser revoke path by safely quoting usernames as SQL string literals when invoking terminateloop(...), preventing statement-structure manipulation.
* sdk: Small bugfixes relating to docker test container cleanup and image building.
* secrets/kmip (enterprise): Address a nil pointer within the invalidation handler for managed objects.
* secrets/pki (enterprise): Include root CA in chain for CIEPS endpoints when root is the direct issuer, unless `remove_roots_from_chain` is true.
* ui/transit: Fix key version dropdown selected state when editing a transit key.
* ui: Fix LDAP check-out capabilities check.
* ui: Fix entities page to show success message after successfully editing an entity.
## 1.20.10 Enterprise
### April 14, 2026
BREAKING CHANGES:
* sdk/helpers/docker: Migrate docker helpers from github.com/docker/docker to github.com/moby/moby. This was necessary as github.com/docker/docker is no longer maintained. Resolves GHSA-x744-4wpc-v9h2 and GHSA-pxq6-2prw-chj9.
SECURITY:
* api/auth/gcp: Update go.opentelemetry.io/otel/sdk to fix CVE-2026-39883.
* api/auth: Update github.com/go-jose/go-jose to fix security vulnerability CVE-2026-34986 and GHSA-78h2-9frx-2jm8.
* core: Correctly remove any Vault tokens from the Authorization header when this header is forwarded to plugin backends. The header will only be forwarded if "Authorization" is explicitly included in the list of passthrough request headers.
* core: Resolve GO-2026-4518 and GHSA-jqcq-xjh3-6g23 by upgrading to github.com/jackc/pgx/v5
* core: Update github.com/aws/aws-sdk-go-v2/ to fix security vulnerability GHSA-xmrv-pmrh-hhx2.
* core: Update github.com/go-jose/go-jose to fix security vulnerability CVE-2026-34986 and GHSA-78h2-9frx-2jm8.
* core: Update github.com/hashicorp/go-getter to fix security vulnerability GHSA-92mm-2pjq-r785.
* core: Update go.opentelemetry.io/otel/sdk to fix CVE-2026-39883.
* core: reject URL-encoded paths that do not specify a canonical path
* sdk: Resolve GO-2026-4518 and GHSA-jqcq-xjh3-6g23 by upgrading to github.com/jackc/pgx/v5
* sdk: Update github.com/go-jose/go-jose to fix security vulnerability CVE-2026-34986 and GHSA-78h2-9frx-2jm8.
CHANGES:
* core: Bump Go version to 1.25.9
* core: Vault now rejects paths that are not canonical, such as paths containing double slashes (`path//to/resource`)
IMPROVEMENTS:
* config/listener: logs warnings on invalid x-forwarded-for configurations.
* dockerfile: container will now run as vault user by default
* pki: Reject obviously unsafe validation targets during ACME HTTP-01 and TLS-ALPN-01 challenge verification
* secrets/pki: Add ACME configuration fields challenge_permitted_ip_ranges and challenge_excluded_ip_ranges configuration to control which IP addresses are allowed or disallowed for challenge validation.
* secrets/pki: Add Freshest CRL extension (Delta CRL Distribution Points) to base CRLs
BUG FIXES:
* audit/file: The logic preventing setting of executable bits on audit devices was enforced at unseal instead of just at new audit device creation, causing an error at unseal if an existing audit device had exec permissions. The logic now warns and clears exec bits to prevent unseal errors.
* auth/gcp: Fix intermittent context canceled failures for Workload Identity Federation (WIF) authentication
* core (Enterprise): fix unaligned atomic panic in replication code on 32-bit platforms.
* core/managed-keys (enterprise): Fix a bug that prevented the max_parallel field of PKCS#11 managed keys from being updated.
* events (enterprise): Fix missed events when multiple event clients specify the same namespace and event type filters and one client disconnects.
* identity: Repair the integrity of duplicate and/or dangling entity aliases.
* ldap auth (enterprise): Fix root password rotation for Active Directory by implementing UTF-16LE encoding and schema-specific handling. Adds new 'schema' config field (defaults to 'openldap' for backward compatibility).
* secret sync (enterprise): fix panic in set-association API when using Vault Proxy with token-bound CIDRs. The panic occurred due to missing connection information during CIDR validation.
* secret sync (enterprise): fixed panic due to nil pointer dereference when reconciling associations. Added guard checks to prevent access to nil references, making association handling more robust.
* secrets/pki: The root/sign-intermediate endpoint max_path_length parameter is now restricted by the signing CA's max_path_length if set.
* secrets/transit (enterprise): Fix bugs that prevent using ML-DSA and SLH-DSA keys after reading the policy from storage.
## 1.20.9 Enterprise
### March 05, 2026
SECURITY:
* Upgrade `cloudflare/circl` to v1.6.3 to resolve CVE-2026-1229
* Upgrade `filippo.io/edwards25519` to v1.1.1 to resolve GO-2026-4503
* vault/sdk: Upgrade `cloudflare/circl` to v1.6.3 to resolve CVE-2026-1229
* vault/sdk: Upgrade `go.opentelemetry.io/otel/sdk` to v1.40.0 to resolve GO-2026-4394
CHANGES:
* core: Bump Go version to 1.25.7
* mfa/duo: Upgrade duo_api_golang client to 0.2.0 to include the new Duo certificate authorities
IMPROVEMENTS:
* core/seal: Enhance sys/seal-backend-status to provide more information about seal backends.
* secrets/kmip (Enterprise): Obey configured best_effort_wal_wait_duration when forwarding kmip requests.
* secrets/pki (enterprise): Return the POSTPKIOperation capability within SCEP GetCACaps endpoint for better legacy client support.
BUG FIXES:
* core (enterprise): Buffer the POST body on binary paths to allow re-reading on non-logical forwarding attempts. Addresses an issue for SCEP, EST and CMPv2 certificate issuances with slow replication of entities
* core/identity (enterprise): Fix excessive logging when updating existing aliases
* core/managed-keys (enterprise): client credentials should not be required when using Azure Managed Identities in managed keys.
* plugins (enterprise): Fix bug where requests to external plugins that modify storage weren't populating the X-Vault-Index response header.
* secrets (pki): Allow issuance of certificates without the server_flag key usage from SCEP, EST and CMPV2 protocols.
* secrets/pki (enterprise): Address cache invalidation issues with CMPv2 on performance standby nodes.
* secrets/pki (enterprise): Address issues using SCEP on performance standby nodes failing due to configuration invalidation issues along with errors writing to storage
* secrets/pki (enterprise): Modify the SCEP GetCACaps endpoint to dynamically reflect the configured encryption and digest algorithms.
* secrets/pki: allow glob-style DNS names in alt_names.
* ui: Fixes login form so `?with=<path>` query param correctly displays only the specified mount when multiple mounts of the same auth type are configured with `listing_visibility="unauth"`
## 1.20.8 Enterprise
### February 05, 2026
SECURITY:
* auth/cert: ensure that the certificate being renewed matches the certificate attached to the session.
CHANGES:
* core: Bump Go version to 1.25.6
IMPROVEMENTS:
* core/managed-keys (enterprise): Allow GCP managed keys to leverage workload identity federation credentials
* secret-sync (enterprise): Added telemetry counters for reconciliation loop operations, including the number of corrections detected,retry attempts, and operation outcomes (success or failure with internal/external cause labels).
* secret-sync (enterprise): Added telemetry counters for sync/unsync operations with status breakdown by destination type, and exposed operation counters in the destinations list API response.
BUG FIXES:
* agent: Fix Vault Agent discarding cached tokens on transient server errors instead of retrying
* core (enterprise): Fix crash when seal HSM is disconnected
* default-auth: Fix issue when specifying "root" explicitly in Default Auth UI
* identity: Fix issue where Vault may consume more memory than intended under heavy authentication load.
* secrets/pki (enterprise): Fix SCEP related digest errors when requests contained compound octet strings
## 1.20.7 Enterprise
### January 07, 2026
CHANGES:
* auth/oci: bump plugin to v0.19.1
* go: bump go version to 1.25.5
* packaging: Container images are now exported using a compressed OCI image layout.
* packaging: UBI container images are now built on the UBI 10 minimal image.
* secrets/azure: Update plugin to [v0.22.1](https://github.com/hashicorp/vault-plugin-secrets-azure/releases/tag/v0.22.1). Improves retry handling during Azure application and service principal creation to reduce transient failures.
* storage: Upgrade aerospike client library to v8.
IMPROVEMENTS:
* core: check rotation manager queue every 5 seconds instead of 10 seconds to improve responsiveness.
* go: update to golang/x/crypto to v0.45.0 to resolve GHSA-f6x5-jh6r-wrfv, GHSA-j5w8-q4qc-rx2x, GO-2025-4134 and GO-2025-4135.
* rotation: Ensure rotations for shared paths only execute on the Primary cluster's active node. Ensure rotations for local paths execute on the cluster-local active node.
* sdk/rotation: Prevent rotation attempts on read-only storage
* secrets-sync (enterprise): Added support for a boolean force_delete flag (default: false).
When set to true, this flag allows deletion of a destination even if its associations cannot be unsynced.
This option should be used only as a last-resort deletion mechanism, as any secrets already synced to the external provider will remain orphaned and require manual cleanup.
BUG FIXES:
* auth/approle (enterprise): Fixed bug that prevented periodic tidy running on performance secondary.
* core/activitylog (enterprise): Resolve a stability issue where Vault Enterprise could encounter a panic during month-end billing activity rollover.
* http: skip JSON limit parsing on cluster listener.
* quotas: Vault now protects plugins with ResolveRole operations from panicking.
on quota creation.
* replication (enterprise): fix rare panic due to race when enabling a secondary with Consul storage.
* rotation: Fix a bug where a performance secondary would panic if a write was made to a local mount.
* secret-sync (enterprise): Improved unsync error handling by treating cases where the destination no longer exists as successful.
* secrets-sync (enterprise): Corrected a bug where the deletion of the latest KV-V2 secret version caused the associated external secret to be deleted entirely. The sync job now implements a version fallback mechanism to find and sync the highest available active version, ensuring continuity and preventing the unintended deletion of the external secret resource.
* ui/kvv2 (enterprise): Fixes listing stale secrets when switching between namespaces that have KV v2 engines with the same mount path.
* ui/pki: Fix handling of values that contain commas in list fields like `crl_distribution_points`.
## 1.20.6 Enterprise
### November 19, 2025
CHANGES:
* auth/kubernetes: Update plugin to [v0.22.5](https://github.com/hashicorp/vault-plugin-auth-kubernetes/releases/tag/v0.22.5)
* core: Bump Go version to 1.24.10
* policies: add VAULT_NEW_PER_ELEMENT_MATCHING_ON_LIST env var to adopt new "contains all" list matching behavior on
allowed_parameters and denied_parameters
IMPROVEMENTS:
* Update github.com/dvsekhvalnov/jose2go to fix security vulnerability CVE-2025-63811.
* auth/ldap: Require non-empty passwords on login command to prevent unauthenticated access to Vault.
* ui/pki: Adds support to configure `server_flag`, `client_flag`, `code_signing_flag`, and `email_protection_flag` parameters for creating/updating a role.
BUG FIXES:
* core/activitylog (enterprise): Fix nil panic when trying reload census manager before activity log is setup.
* core/rotation: avoid shifting timezones by ignoring cron.SpecSchedule
* ui/pki: Fixes certificate parsing of the `key_usage` extension so details accurately reflect certificate values.
* ui/pki: Fixes creating and updating a role so `basic_constraints_valid_for_non_ca` is correctly set.
* ui: Resolved a regression that prevented users with create and update permissions on KV v1 secrets from opening the edit view. The UI now correctly recognizes these capabilities and allows editing without requiring full read access.
* ui: Update LDAP accounts checked-in table to display hierarchical LDAP libraries
* ui: Update LDAP library count to reflect the total number of nodes instead of number of directories
* ui: remove unnecessary 'credential type' form input when generating AWS secrets
## 1.20.5 Enterprise
### October 22, 2025
SECURITY:
* auth/aws: fix an issue where a user may be able to bypass authentication to Vault due to incorrect caching of the AWS client
* ui: disable scarf analytics for ui builds
CHANGES:
* core: Bump Go version to 1.24.9.
* http: Evaluate rate limit quotas before checking JSON limits during request handling.
IMPROVEMENTS:
* core/metrics: Reading and listing from a snapshot are now tracked via the `vault.route.read-snapshot.{mount_point}` and `vault.route.list-snapshot.{mount_point}` metrics.
* secrets/database: Add root rotation support for Snowflake database secrets engines using key-pair credentials.
BUG FIXES:
* activity (enterprise): sys/internal/counters/activity outputs the correct mount type when called from a non root namespace
* auth: fixed panic when suppling integer as a lease_id in renewal.
* core (enterprise): Avoid duplicate seal rewrapping, and ensure that cluster secondaries rewrap after a seal migration.
* core: interpret all new rotation manager rotation_schedules as UTC to avoid inadvertent use of tz-local
* core: resultant-acl now merges segment-wildcard (`+`) paths with existing prefix rules in `glob_paths`, so clients receive a complete view of glob-style permissions. This unblocks UI sidebar navigation checks and namespace access banners.
* secrets/database: respect the escaping/disable_escaping state when using self-managed static roles
* sentinel (enterprise): Fix a Sentinel bug, where the soft-mandatory policy override would not work in overriding request denial. Now, Vault correctly allows requests when the policy override flag is set. Previously, requests were denied even if an override was explicitly set. Error messaging for denied requests is now clearer and more actionable.
* ui (enterprise): Fixes login form so input renders correctly when token is a preferred login method for a namespace.
* ui: Fixes permissions for hiding and showing sidebar navigation items for policies that include special characters: `+`, `*`
## 1.20.4
### September 24, 2025
SECURITY:
* core: Update github.com/ulikunitz/xz to fix security vulnerability GHSA-25xm-hr59-7c27. ([ce4b4264](https://github.com/hashicorp/vault/commit/ce4b42642403f30370dde0a39e9a04991c387291))
CHANGES:
* database/snowflake: Update plugin to [v0.14.2](https://github.com/hashicorp/vault-plugin-database-snowflake/releases/tag/v0.14.2) ([9f06df77](https://github.com/hashicorp/vault/commit/9f06df77b48024350fbc67b7d9a7eaaa5d0022fa))
IMPROVEMENTS:
* Raft: Auto-join will now allow you to enforce IPv4 on networks that allow IPv6 and dual-stack enablement, which is on by default in certain regions. ([1fd38796](https://github.com/hashicorp/vault/commit/1fd38796639ed861fc2fa1b58f138caad8fc0950))
* auth/cert: Support RFC 9440 colon-wrapped Base64 certificates in `x_forwarded_for_client_cert_header`, to fix TLS certificate auth errors with Google Cloud Application Load Balancer. [[GH-31501](https://github.com/hashicorp/vault/pull/31501)]
* secrets/database (enterprise): Add support for reading, listing, and recovering static roles from a loaded snapshot. Also add support for reading static credentials from a loaded snapshot. ([24cd1aa5](https://github.com/hashicorp/vault/commit/24cd1aa5961bfbed396251aebd3490dcfc7a106f))
* secrets/ssh: Add support for recovering the SSH plugin CA from a loaded snapshot (enterprise only). ([0087af9d](https://github.com/hashicorp/vault/commit/0087af9da59692351e7a3c3f5269af9de082a52e))
BUG FIXES:
* auth/cert: Recover from partially populated caches of trusted certificates if one or more certificates fails to load. [[GH-31438](https://github.com/hashicorp/vault/pull/31438)]
* core: Role based quotas now work for cert auth ([fc775dea](https://github.com/hashicorp/vault/commit/fc775deacee3ab2dd956b8ab7ab64847601c1685))
* sys/mounts: enable unsetting allowed_response_headers [[GH-31555](https://github.com/hashicorp/vault/pull/31555)]
* ui: Fix page loading error when users navigate away from identity entities and groups list views. ([81170963](https://github.com/hashicorp/vault/commit/8117096364d5fbb541124a6e057cd11b24eaa6f3))
## 1.20.3
### August 28, 2025
FEATURES:
* **IBM RACF Static Role Password Phrase Management (Enterprise)**: Add support for static role password phrase management to the LDAP secrets engine. (https://github.com/hashicorp/vault-plugin-secrets-openldap/pull/184)
SECURITY:
* core: Update github.com/hashicorp/go-getter to fix security vulnerability GHSA-wjrx-6529-hcj3. ([8b3a9ce1](https://github.com/hashicorp/vault/commit/8b3a9ce1f651932559a129a7889243d24127cee2))
CHANGES:
* core: Bump Go version to 1.24.6. ([ce56e14e](https://github.com/hashicorp/vault/commit/ce56e14e7466ae80e05d11a83c8f41db0f4653be))
* http: Add JSON configurable limits to HTTP handling for JSON payloads: `max_json_depth`, `max_json_string_value_length`, `max_json_object_entry_count`, `max_json_array_element_count`. [[GH-31069](https://github.com/hashicorp/vault/pull/31069)]
* sdk: Upgrade to go-secure-stdlib/plugincontainer@v0.4.2, which also bumps github.com/docker/docker to v28.3.3+incompatible ([8f172169](https://github.com/hashicorp/vault/commit/8f1721697bba123117f4f98dae4154ef9fe614e5))
* secrets/openldap (enterprise): update plugin to v0.16.1
IMPROVEMENTS:
* auth/ldap: add explicit logging to rotations in ldap [[GH-31401](https://github.com/hashicorp/vault/pull/31401)]
* core (enterprise): improve rotation manager logging to include specific lines for rotation success and failure
* secrets/database: log password rotation success (info) and failure (error). Some relevant log lines have been updated to include "path" fields. [[GH-31402](https://github.com/hashicorp/vault/pull/31402)]
* secrets/transit: add logging on both success and failure of key rotation [[GH-31420](https://github.com/hashicorp/vault/pull/31420)]
* ui: Use the Helios Design System Code Block component for all readonly code editors and use its Code Editor component for all other code editors [[GH-30188](https://github.com/hashicorp/vault/pull/30188)]
BUG FIXES:
* core (enterprise): fix a bug where issuing a token in a namespace used root auth configuration instead of namespace auth configuration
* core/metrics: Add service name prefix for core HA metrics to avoid duplicate, zero-value metrics. ([91e5f443](https://github.com/hashicorp/vault/commit/91e5f44315fb52c37b54e8b0eece1b4390665cc3))
* core/seal: When Seal-HA is enabled, make it an error to persist the barrier
keyring when not all seals are healthy. This prevents the possibility of
failing to unseal when a different subset of seals are healthy than were
healthy at last write. ([bbe64227](https://github.com/hashicorp/vault/commit/bbe64227c586cb34f73d9ae8025398f24aa7e12d))
* raft (enterprise): auto-join will now work in regions that do not support dual-stack ([c66baf5e](https://github.com/hashicorp/vault/commit/c66baf5ee1ee9320daa6af5528cb2f250f2a0f3a))
* raft/autopilot: Fixes an issue with enterprise redundancy zones where, if the leader was in a redundancy zone and that leader becomes unavailable, the node would become an unzoned voter. This can artificially inflate the required number of nodes for quorum, leading to a situation where the cluster cannot recover if another leader subsequently becomes unavailable. Vault will now keep an unavailable node in its last known redundancy zone as a non-voter. [[GH-31443](https://github.com/hashicorp/vault/pull/31443)]
* replication (enterprise): Fix bug where group updates fail when processed on a
standby node in a PR secondary cluster.
* secrets-sync (enterprise): GCP locational KMS keys are no longer incorrectly removed when the location name is all lowercase.
* secrets/database/postgresql: Support for multiline statements in the `rotation_statements` field. [[GH-31442](https://github.com/hashicorp/vault/pull/31442)]
* ui: Fix DR secondary view from not loading/transitioning. [[GH-31478](https://github.com/hashicorp/vault/pull/31478)]
## 1.20.2
### August 06, 2025
SECURITY:
* auth/ldap: fix MFA/TOTP enforcement bypass when username_as_alias is enabled [[GH-31427](https://github.com/hashicorp/vault/pull/31427),[HCSEC-2025-20](https://discuss.hashicorp.com/t/hcsec-2025-20-vault-ldap-mfa-enforcement-bypass-when-using-username-as-alias/76092)].
BUG FIXES:
* agent/template: Fixed issue where templates would not render correctly if namespaces was provided by config, and the namespace and mount path of the secret were the same. [[GH-31392](https://github.com/hashicorp/vault/pull/31392)]
* identity/mfa: revert cache entry change from #31217 and document cache entry values [[GH-31421](https://github.com/hashicorp/vault/pull/31421)]
## 1.20.1
### July 25, 2025
SECURITY:
* audit: **breaking change** privileged vault operator may execute code on the underlying host (CVE-2025-6000). Vault will not unseal if the only configured file audit device has executable permissions (e.g., 0777, 0755). See recent [breaking change](https://developer.hashicorp.com/vault/docs/updates/important-changes#breaking-changes) docs for more details. [[GH-31211](https://github.com/hashicorp/vault/pull/31211),[HCSEC-2025-14](https://discuss.hashicorp.com/t/hcsec-2025-14-privileged-vault-operator-may-execute-code-on-the-underlying-host/76033)]
* auth/userpass: timing side-channel in vault's userpass auth method (CVE-2025-6011)[HCSEC-2025-15](https://discuss.hashicorp.com/t/hcsec-2025-15-timing-side-channel-in-vault-s-userpass-auth-method/76034)
* core/login: vault userpass and ldap user lockout bypass (CVE-2025-6004). update alias lookahead to respect username case for LDAP and username/password. [[GH-31352](https://github.com/hashicorp/vault/pull/31352),[HCSEC-2025-16](https://discuss.hashicorp.com/t/hcsec-2025-16-vault-userpass-and-ldap-user-lockout-bypass/76035)]
* secrets/totp: vault totp secrets engine code reuse (CVE-2025-6014) [[GH-31246](https://github.com/hashicorp/vault/pull/31246),[HCSEC-2025-17](https://discuss.hashicorp.com/t/hcsec-2025-17-vault-totp-secrets-engine-code-reuse/76036)]
* auth/cert: vault certificate auth method did not validate common name for non-ca certificates (CVE-2025-6037). test non-CA cert equality on login matching instead of individual fields. [[GH-31210](https://github.com/hashicorp/vault/pull/31210),[HCSEC-2025-18](https://discuss.hashicorp.com/t/hcsec-2025-18-vault-certificate-auth-method-did-not-validate-common-name-for-non-ca-certificates/76037)]
* core/mfa: vault login mfa bypass of rate limiting and totp token reuse (CVE-2025-6015) [[GH-31217](https://github.com/hashicorp/vault/pull/31297),[HCSEC-2025-19](https://discuss.hashicorp.com/t/hcsec-2025-19-vault-login-mfa-bypass-of-rate-limiting-and-totp-token-reuse/76038)]
FEATURES:
* **Post-Quantum Cryptography Support**: Experimental support for PQC signatures with SLH-DSA in Transit.
IMPROVEMENTS:
* Plugin Downloads (enterprise): add CLI `-download` option for plugin register (beta)
* openapi: Add OpenAPI support for secret recovery operations. [[GH-31331](https://github.com/hashicorp/vault/pull/31331)]
* plugins: Clarify usage of sha256, command, and version for plugin registration of binary or artifact with API and CLI. Introduce new RegisterPluginDetailed and RegisterPluginWtihContextDetailed functions to API client to propagate response along with error, and mark RegisterPlugin and RegisterPluginWithContext as deprecated. [[GH-30811](https://github.com/hashicorp/vault/pull/30811)]
* secrets/pki (enterprise): enable separately-configured logging for SCEP-enrollment.
* secrets/pki: Add the digest OID when logging SCEP digest mismatch errors. [[GH-31232](https://github.com/hashicorp/vault/pull/31232)]
BUG FIXES:
* activity (enterprise): Fix `development_cluster` setting being overwritten on performance secondaries upon cluster reload. [[GH-31223](https://github.com/hashicorp/vault/pull/31223)]
* auth/scep (enterprise): enforce the token_bound_cidrs role parameter within SCEP roles
* auto-reporting (enterprise): Clarify debug logs to accurately reflect when automated license utilization reporting is enabled or disabled, especially since manual reporting is always initialized.
* core/seal (enterprise): Fix a bug that caused the seal rewrap process to abort in the presence of partially sealed entries.
* kmip (enterprise): Fix a panic that can happen when a KMIP client makes a request before the Vault server has finished unsealing. [[GH-31266](https://github.com/hashicorp/vault/pull/31266)]
* plugins: Fix panics that can occur when a plugin audits a request or response before the Vault server has finished unsealing. [[GH-31266](https://github.com/hashicorp/vault/pull/31266)]
* product usage reporting (enterprise): Clarify debug logs to accurately reflect when anonymous product usage reporting is enabled or disabled, especially since manual reporting is always initialized.
* replication (enterprise): Fix bug with mount invalidations consuming excessive memory.
* secrets-sync (enterprise): Unsyncing secret-key granularity associations will no longer give a misleading error about a failed unsync operation that did indeed succeed.
* secrets/gcp: Update to vault-plugin-secrets-gcp@v0.22.1 to address more eventual consistency issues [[GH-31350](https://github.com/hashicorp/vault/pull/31350)]
* ui: Fix capability checks for api resources with underscores to properly hide actions and dropdown items a user cannot perform [[GH-31271](https://github.com/hashicorp/vault/pull/31271)]
* ui: Fix kv v2 overview page from erroring if a user does not have access to the /subkeys endpoint and the policy check fails. [[GH-31136](https://github.com/hashicorp/vault/pull/31136)]
* ui: Fix mutation of unwrapped data when keys contain underscores [[GH-31287](https://github.com/hashicorp/vault/pull/31287)]
* ui: Fix regression in 1.20.0 to properly set namespace context for capabilities checks [[GH-31276](https://github.com/hashicorp/vault/pull/31276)]
* ui: Fix selecting multiple namespaces in the namespace picker when the path contains matching nodes [[GH-31326](https://github.com/hashicorp/vault/pull/31326)]
* ui: Fixes UI login settings list page which was not rendering rules with an underscore in the name. [[GH-31150](https://github.com/hashicorp/vault/pull/31150)]
* ui: Include user's root namespace in the namespace picker if it's a namespace other than the actual root ("") [[GH-31300](https://github.com/hashicorp/vault/pull/31300)]
* ui: Revert camelizing of parameters returned from `sys/internal/ui/mounts` so mount paths match serve value [[GH-31094](https://github.com/hashicorp/vault/pull/31094)]
## 1.20.0
### June 25, 2025
SECURITY:
* core: require a nonce when cancelling a rekey operation that was initiated within the last 10 minutes. [[GH-30794](https://github.com/hashicorp/vault/pull/30794)],[[HCSEC-2025-11](https://discuss.hashicorp.com/t/hcsec-2025-11-vault-vulnerable-to-recovery-key-cancellation-denial-of-service/75570)]
* core/identity: vault root namespace operator may elevate privileges (CVE-2025-5999). Fix string contains check in Identity APIs to be case-insensitive. [[GH-31045](https://github.com/hashicorp/vault/pull/31045),[HCSEC-2025-13](https://discuss.hashicorp.com/t/hcsec-2025-13-vault-root-namespace-operator-may-elevate-token-privileges/76032)]
CHANGES:
* UI: remove outdated and unneeded js string extensions [[GH-29834](https://github.com/hashicorp/vault/pull/29834)]
* activity (enterprise): The sys/internal/counters/activity endpoint will return actual values for new clients in the current month.
* activity (enterprise): provided values for `start_time` and `end_time` in `sys/internal/counters/activity` are aligned to the corresponding billing period.
* activity: provided value for `end_time` in `sys/internal/counters/activity` is now capped at the end of the last completed month. [[GH-30164](https://github.com/hashicorp/vault/pull/30164)]
* api: Update the default API client to check for the `Retry-After` header and, if it exists, wait for the specified duration before retrying the request. [[GH-30887](https://github.com/hashicorp/vault/pull/30887)]
* auth/alicloud: Update plugin to v0.21.0 [[GH-30810](https://github.com/hashicorp/vault/pull/30810)]
* auth/azure: Update plugin to v0.20.2. Login requires `resource_group_name`, `vm_name`, and `vmss_name` to match token claims [[GH-30052](https://github.com/hashicorp/vault/pull/30052)]
* auth/azure: Update plugin to v0.20.3 [[GH-30082](https://github.com/hashicorp/vault/pull/30082)]
* auth/azure: Update plugin to v0.20.4 [[GH-30543](https://github.com/hashicorp/vault/pull/30543)]
* auth/azure: Update plugin to v0.21.0 [[GH-30872](https://github.com/hashicorp/vault/pull/30872)]
* auth/azure: Update plugin to v0.21.1 [[GH-31010](https://github.com/hashicorp/vault/pull/31010)]
* auth/cf: Update plugin to v0.20.1 [[GH-30583](https://github.com/hashicorp/vault/pull/30583)]
* auth/cf: Update plugin to v0.21.0 [[GH-30842](https://github.com/hashicorp/vault/pull/30842)]
* auth/gcp: Update plugin to v0.20.2 [[GH-30081](https://github.com/hashicorp/vault/pull/30081)]
* auth/jwt: Update plugin to v0.23.2 [[GH-30431](https://github.com/hashicorp/vault/pull/30431)]
* auth/jwt: Update plugin to v0.24.1 [[GH-30876](https://github.com/hashicorp/vault/pull/30876)]
* auth/kerberos: Update plugin to v0.15.0 [[GH-30845](https://github.com/hashicorp/vault/pull/30845)]
* auth/kubernetes: Update plugin to v0.22.1 [[GH-30910](https://github.com/hashicorp/vault/pull/30910)]
* auth/oci: Update plugin to v0.19.0 [[GH-30841](https://github.com/hashicorp/vault/pull/30841)]
* auth/saml: Update plugin to v0.6.0
* core: Bump Go version to 1.24.4.
* core: Verify that the client IP address extracted from an X-Forwarded-For header is a valid IPv4 or IPv6 address [[GH-29774](https://github.com/hashicorp/vault/pull/29774)]
* database/couchbase: Update plugin to v0.14.0 [[GH-30836](https://github.com/hashicorp/vault/pull/30836)]
* database/elasticsearch: Update plugin to v0.18.0 [[GH-30796](https://github.com/hashicorp/vault/pull/30796)]
* database/mongodbatlas: Update plugin to v0.15.0 [[GH-30856](https://github.com/hashicorp/vault/pull/30856)]
* database/redis-elasticache: Update plugin to v0.7.0 [[GH-30785](https://github.com/hashicorp/vault/pull/30785)]
* database/redis: Update plugin to v0.6.0 [[GH-30797](https://github.com/hashicorp/vault/pull/30797)]
* database/snowflake: Update plugin to v0.14.0 [[GH-30748](https://github.com/hashicorp/vault/pull/30748)]
* database/snowflake: Update plugin to v0.14.1 [[GH-30868](https://github.com/hashicorp/vault/pull/30868)]
* logical/system: add ent stub for plugin catalog handling [[GH-30890](https://github.com/hashicorp/vault/pull/30890)]
* quotas/rate-limit: Round up the `Retry-After` value to the nearest second when calculating the retry delay. [[GH-30887](https://github.com/hashicorp/vault/pull/30887)]
* secrets/ad: Update plugin to v0.21.0 [[GH-30819](https://github.com/hashicorp/vault/pull/30819)]
* secrets/alicloud: Update plugin to v0.20.0 [[GH-30809](https://github.com/hashicorp/vault/pull/30809)]
* secrets/azure: Update plugin to v0.21.2 [[GH-30037](https://github.com/hashicorp/vault/pull/30037)]
* secrets/azure: Update plugin to v0.21.3 [[GH-30083](https://github.com/hashicorp/vault/pull/30083)]
* secrets/azure: Update plugin to v0.22.0 [[GH-30832](https://github.com/hashicorp/vault/pull/30832)]
* secrets/gcp: Update plugin to v0.21.2 [[GH-29970](https://github.com/hashicorp/vault/pull/29970)]
* secrets/gcp: Update plugin to v0.21.3 [[GH-30080](https://github.com/hashicorp/vault/pull/30080)]
* secrets/gcp: Update plugin to v0.22.0 [[GH-30846](https://github.com/hashicorp/vault/pull/30846)]
* secrets/gcpkms: Update plugin to v0.21.0 [[GH-30835](https://github.com/hashicorp/vault/pull/30835)]
* secrets/kubernetes: Update plugin to v0.11.0 [[GH-30855](https://github.com/hashicorp/vault/pull/30855)]
* secrets/kv: Update plugin to v0.24.0 [[GH-30826](https://github.com/hashicorp/vault/pull/30826)]
* secrets/mongodbatlas: Update plugin to v0.15.0 [[GH-30860](https://github.com/hashicorp/vault/pull/30860)]
* secrets/openldap: Update plugin to v0.15.2 [[GH-30079](https://github.com/hashicorp/vault/pull/30079)]
* secrets/openldap: Update plugin to v0.15.4 [[GH-30279](https://github.com/hashicorp/vault/pull/30279)]
* secrets/openldap: Update plugin to v0.16.0 [[GH-30844](https://github.com/hashicorp/vault/pull/30844)]
* secrets/terraform: Update plugin to v0.12.0 [[GH-30905](https://github.com/hashicorp/vault/pull/30905)]
* server: disable_mlock configuration option is now required for integrated storage and no longer has a default. If you are using the default value with integrated storage, you must now explicitly set disable_mlock to true or false or Vault server will fail to start. [[GH-29974](https://github.com/hashicorp/vault/pull/29974)]
* ui/activity: Replaces mount and namespace attribution charts with a table to allow sorting
client count data by `namespace`, `mount_path`, `mount_type` or number of clients for
a selected month. [[GH-30678](https://github.com/hashicorp/vault/pull/30678)]
* ui: Client count side nav link 'Vault Usage Metrics' renamed to 'Client Usage' [[GH-30765](https://github.com/hashicorp/vault/pull/30765)]
* ui: Client counting "running total" charts now reflect new clients only [[GH-30506](https://github.com/hashicorp/vault/pull/30506)]
* ui: Removed `FormError` component (not used) [[GH-34699](https://github.com/hashicorp/vault/pull/34699)]
* ui: Selecting a different method in the login form no longer updates the `/vault/auth?with=` query parameter [[GH-30500](https://github.com/hashicorp/vault/pull/30500)]
* ui: `/vault/auth?with=` query parameter now exclusively refers to the auth mount path and renders a simplified form [[GH-30500](https://github.com/hashicorp/vault/pull/30500)]
FEATURES:
* **Auto Irrevocable Lease Removal (Enterprise)**: Add the Vault Enterprise configuration param, `remove_irrevocable_lease_after`. When set to a non-zero value, this will automatically delete irrevocable leases after the configured duration exceeds the lease's expire time. The minimum duration allowed for this field is two days. [[GH-30703](https://github.com/hashicorp/vault/pull/30703)]
* **Development Cluster Configuration (Enterprise)**: Added `development_cluster` as a field to Vault's utilization reports.
The field is configurable via HCL and indicates whether the cluster is being used in a development environment, defaults to false if not set. [[GH-30659](https://github.com/hashicorp/vault/pull/30659)]
* **Entity-based and collective rate limit quotas (Enterprise)**: Add new `group_by` field to the rate limit quota API to support different grouping modes.
* **Login form customization (Enterprise)**: Adds support to choose a default and/or backup auth methods for the web UI login form to streamline the web UI login experience. [[GH-30700](https://github.com/hashicorp/vault/pull/30700)]
* **Plugin Downloads**: Support automatically downloading official HashiCorp secret and auth plugins from releases.hashicorp.com (beta)
* **SSH Key Signing Improvements (Enterprise)**: Add support for using managed keys to sign SSH keys in the SSH secrets engine.
* **Secret Recovery from Snapshot (Enterprise)**: Adds a framework to load an integrated storage
snapshot into Vault and read, list, and recover KV v1 and cubbyhole secrets from the snapshot. [[GH-30739](https://github.com/hashicorp/vault/pull/30739)]
* **UI Secrets Engines**: TOTP secrets engine is now supported. [[GH-29751](https://github.com/hashicorp/vault/pull/29751)]
* **UI Telemetry**: Add Posthog for UI telemetry tracking on Vault Dedicated managed clusters [[GH-30425](https://github.com/hashicorp/vault/pull/30425)]
* **Vault Namespace Picker**: Updating the Vault Namespace Picker to enable search functionality, allow direct navigation to nested namespaces and improve accessibility. [[GH-30490](https://github.com/hashicorp/vault/pull/30490)]
* **Vault PKI SCEP Server (Enterprise)**: Support for the Simple Certificate Enrollment Protocol (SCEP) has been added to the Vault PKI Plugin. This allows standard SCEP clients to request certificates from a Vault server with no knowledge of Vault APIs.
IMPROVEMENTS:
* activity (enterprise): Added vault.client.billing_period.activity telemetry metric to emit information about the total number of distinct clients used in the current billing period.
* activity: mount_type was added to the API response of sys/internal/counters/activity [[GH-30071](https://github.com/hashicorp/vault/pull/30071)]
* activity: mount_type was added to the API response of sys/internal/counters/activity
* api (enterprise): Added a new API, `/sys/utilization-report`, giving a snapshot overview of Vault's utilization at a high level.
* api/client: Add Cert auth method support. This allows the client to authenticate using a client certificate. [[GH-29546](https://github.com/hashicorp/vault/pull/29546)]
* core (enterprise): Updated code and documentation to support FIPS 140-3 compliant algorithms.
* core (enterprise): allow a root token to relock a namespace locked by the Namespace API Lock feature.
* core (enterprise): report errors from the underlying seal when getting entropy.
* core (enterprise): update to FIPS 140-3 cryptographic module in the FIPS builds.
* core/metrics: added a new telemetry metric, `vault.core.response_status_code`, with two labels, `code`, and `type`, detailing the status codes of all responses to requests that Vault handles. [[GH-30354](https://github.com/hashicorp/vault/pull/30354)]
* core: Improve memory use of path management for namespaces, auth methods, and secrets engines. Now Vault should handle larger numbers of namespaces and multiple instances of the same secrets engine or auth method more efficiently. [[GH-31022](https://github.com/hashicorp/vault/pull/31022)]
* core: Updated code and documentation to support FIPS 140-3 compliant algorithms. [[GH-30576](https://github.com/hashicorp/vault/pull/30576)]
* core: support for X25519MLKEM768 (post quantum key agreement) in the Go TLS stack. [[GH-30603](https://github.com/hashicorp/vault/pull/30603)]
* events: Add `vault_index` to an event's metadata if the metadata contains `modified=true`, to support client consistency controls when reading from Vault in response to an event where storage was modified. [[GH-30725](https://github.com/hashicorp/vault/pull/30725)]
* physical/postgres: Adds support to authenticate with the PostgreSQL Backend server with cloud based identities (AWS IAM, Azure MSI and GCP IAM) [[GH-30681](https://github.com/hashicorp/vault/pull/30681)]
* plugins: Support registration of CE plugins with extracted artifact directory. [[GH-30673](https://github.com/hashicorp/vault/pull/30673)]
* secrets/aws: Add LIST endpoint to the AWS secrets engine static roles. [[GH-29842](https://github.com/hashicorp/vault/pull/29842)]
* secrets/pki: Add Delta (Freshest) CRL support to AIA information (both mount-level and issuer configured) [[GH-30319](https://github.com/hashicorp/vault/pull/30319)]
* secrets/transit (enterprise): enable the use of 192-bit keys for AES CMAC
* storage/mysql: Added support for getting mysql backend username and password from the environment variables `VAULT_MYSQL_USERNAME` and `VAULT_MYSQL_PASSWORD`. [[GH-30136](https://github.com/hashicorp/vault/pull/30136)]
* storage/raft: Upgrade hashicorp/raft library to v1.7.3 which includes additional logging on the leader when opening and sending a snapshot to a follower. [[GH-29976](https://github.com/hashicorp/vault/pull/29976)]
* transit: Exclude the partial wrapping key path from the transit/keys LIST operation. [[GH-30728](https://github.com/hashicorp/vault/pull/30728)]
* ui (enterprise): Replace date selector in client count usage page with fixed start and end dates that align with billing periods in order to return more relevant client counting data. [[GH-30349](https://github.com/hashicorp/vault/pull/30349)]
* ui/database: Adding input field for setting skip static role password rotation for database connection config, updating static role skip field to use toggle button [[GH-29820](https://github.com/hashicorp/vault/pull/29820)]
* ui/database: Adding password input field for creating a static role [[GH-30275](https://github.com/hashicorp/vault/pull/30275)]
* ui/database: Adding warning modal pop up when creating a static role that will be rotated immediately [[GH-30119](https://github.com/hashicorp/vault/pull/30119)]
* ui/database: Glimmerizing and adding validations to role create [[GH-29754](https://github.com/hashicorp/vault/pull/29754)]
* ui/database: Updating toggle buttons for skip_rotation_import to reverse polarity of values that get displayed versus whats sent to api [[GH-30055](https://github.com/hashicorp/vault/pull/30055)]
* ui: Add 'Refresh list' button to the namespace list page. [[GH-30692](https://github.com/hashicorp/vault/pull/30692)]
* ui: Enable search for a namespace on the namespace list page. [[GH-30680](https://github.com/hashicorp/vault/pull/30680)]
* ui: Hide "Other" tab when mounts are configured with `listing_visibility="unauth"`; all methods can be accessed via the "Sign in with other methods" link [[GH-30500](https://github.com/hashicorp/vault/pull/30500)]
* ui: Improve accessibility of login form to meet a11y standards [[GH-30500](https://github.com/hashicorp/vault/pull/30500)]
* ui: Replaces all instances of the deprecated event.keyCode with event.key [[GH-30493](https://github.com/hashicorp/vault/pull/30493)]
* ui: Update date selector in client count usage page to disable current month selection for Vault clusters without a license. [[GH-30488](https://github.com/hashicorp/vault/pull/30488)]
* ui: Use Hds::CodeBlock component to replace readonly JsonEditor instances [[GH-29720](https://github.com/hashicorp/vault/pull/29720)]
* ui: adds key value pair string inputs as optional form for wrap tool [[GH-29677](https://github.com/hashicorp/vault/pull/29677)]
* ui: remove ember-svg-jar dependency [[GH-30181](https://github.com/hashicorp/vault/pull/30181)]
DEPRECATIONS:
* api: Deprecated the `/sys/internal/counters/tokens` endpoint. Attempting to call this endpoint will return a 403 "unsupported path" exception. [[GH-30561](https://github.com/hashicorp/vault/pull/30561)]
* core: deprecate duplicate attributes in HCL configuration files and policy definitions [[GH-30386](https://github.com/hashicorp/vault/pull/30386)]
BUG FIXES:
* api/tokenhelper: Exec token_helper without a shell [[GH-29653](https://github.com/hashicorp/vault/pull/29653)]
* auth/aws: fix a panic when a performance standby node attempts to write/update config. [[GH-30039](https://github.com/hashicorp/vault/pull/30039)]
* auth/ldap: Fix a bug that does not properly delete users and groups by first converting their names to lowercase when case senstivity option is off. [[GH-29922](https://github.com/hashicorp/vault/pull/29922)]
* auth/ldap: fix a panic when a performance standby node attempts to write/update config. [[GH-30039](https://github.com/hashicorp/vault/pull/30039)]
* aws/secrets: Prevent vault from rejecting secret role configurations where no regions or endpoints are set [[GH-29996](https://github.com/hashicorp/vault/pull/29996)]
* core (enterprise): add nil check before attempting to use Rotation Manager operations.
* core (enterprise): fix a bug where plugin automated root rotati