<![CDATA[Vault - Package Updates]]>You can use this thread to track updates to the Vault package.

Please open issues in a separate topic instead of replying here.

]]>https://forum.cloudron.io/topic/2783/vault-package-updatesRSS for NodeTue, 15 Sep 2026 15:27:46 GMTMon, 06 Jul 2020 20:44:54 GMT60<![CDATA[Reply to Vault - Package Updates on Wed, 02 Sep 2026 07:32:52 GMT]]>[1.84.0]

  • Update vault to 2.1.0
  • Full Changelog
  • core: Update go.etcd.io/etcd/client/pkg/v3 to v3.7.1 to fix security vulnerability GO-2026-6107.
  • core: Update software.sslmate.com/src/go-pkcs12 to v0.7.2 to fix security vulnerability GO-2026-5052.
  • Agent Registry UI (enterprise): Adds a new Agentic Security section to the primary navigation with an Agent Registry page where operators can view, search, and manage registered AI agents, their associated Vault entities and aliases, assigned policies, and operational status.
  • Automatic DNS-01 Challenge Fulfillment for PKI External CA: Integrate with the following DNS providers for automatic DNS-01 challenge fulfillment: AWS Route53, Azure DNS, Google Cloud DNS, and BIND and other RFC2136-compliant servers.
  • PKI PKCS#12 and JKS Support: Adds support for PKCS#12 (PFX) and Java keytool (JKS) certificate bundles to relevant PKI endpoints. Bundles are returned as base64-encoded, password-protected files.
  • SLH-DSA support for Hybrid sign/verify in Transit engine (enterprise): Add support for SLH-DSA as the PQC component for Hybrid sign/verify operations. This is compatible with both ECDSA (p-256, P-384, P-521) and Ed25519.
  • agent/pki-external-ca: Fix CA chain extraction from Vault PKI API responses where ca_chain field was always empty in templates due to incorrect type handling of array responses
  • api: Account for the HTTP Age header when calculating a lease's remaining lifetime, so that leases read or renewed through a caching proxy such as Vault Agent are renewed before they expire.
  • core/login: Fix panic on malformed login requests. Vault now returns an error for malformed login payloads instead of dropping the client connection (no data loss).
  • secrets/database: Sanitize the caller-controlled DisplayName before it is used in generated usernames to prevent SQL injection via username templates. Adds a configuration warning when a username_template references DisplayName without a truncate function.
]]>https://forum.cloudron.io/post/128856https://forum.cloudron.io/post/128856Wed, 02 Sep 2026 07:32:52 GMT<![CDATA[Reply to Vault - Package Updates on Wed, 05 Aug 2026 00:04:48 GMT]]>[1.83.5]

  • Update vault to 2.0.4
  • Full Changelog
  • containers: The following packages have been removed from UBI based container images: gnupg, openssl, procps.
  • acl: Fix privilege-escalation vulnerability where a denied_parameters constraint on the policies request field could be bypassed by submitting a mixed-case policy name (e.g. "Super-Admin" instead of "super-admin"). Vault now normalizes the policies parameter to lowercase before evaluating allowed_parameters/denied_parameters constraints.
  • core: remove support for duplicate attributes in HCL configuration files and policy definitions. Parsing HCL with duplicate attributes now always fails, and the VAULT_ALLOW_PENDING_REMOVAL_DUPLICATE_HCL_ATTRIBUTES environment variable that previously restored the legacy behavior has been removed.
  • secrets: Added ability to view secrets in YAML format
  • auth/cert: Support login via x-forwarded cert headers even with tls disabled on the vault listener.
  • Proxy/Agent: Fixed a bug where auth method headers accumulated on the shared API client across re-auth cycles.
  • audit: Fix a regression from CVE-2025-6000 that broke enabling audit devices on Windows when a plugin directory was configured.
  • auth/cert: Add support for x-forwarded cert headers coming from AWS ALBs.
  • core: Preserve URL query parameters when redirecting API requests containing duplicate slashes to their canonical path. Previously, the redirect dropped parameters such as ?list=true, potentially changing the result of the request.
  • secrets-sync: Fix GCP Secret Manager destinations losing their per-region KMS key on Vault restart.
]]>https://forum.cloudron.io/post/127723https://forum.cloudron.io/post/127723Wed, 05 Aug 2026 00:04:48 GMT<![CDATA[Reply to Vault - Package Updates on Thu, 18 Jun 2026 07:08:03 GMT]]>[1.83.4]

  • Update vault to 2.0.3
  • Full Changelog
  • auth/radius: Added case_insensitive_names toggle to prevent username collisions and enable case-insensitive user handling.
  • core/acl: Fix LIST ACL bypass where a trailing-slash request could skip a more-specific deny rule.
  • core: Use constant-time recovery token comparison
  • core/acl: LIST requests with a trailing slash now correctly respect more-specific deny policies. Previously, a deny on path "kv/*" { deny } could be bypassed for LIST kv/private/ if a broader allow path "kv/*" also existed. Policies relying on the previous (incorrect) behavior may now be denied.
  • core: Vault will now redirect non-canonicalized paths (containing /./, /../, or //) to a cleaned path, instead of rejecting these requests
  • AI Agent Support (Beta/Enterprise): Adds beta support for first-class AI agents. Adds an Agent Registry to register agents, and adds support for using Vault as an OAuth resource server for registered agent entities. When configured, allows OAuth 2.0 JWTs to be used to directly authorize requests to Vault, without needing a Vault token.
  • core/rotationMgr: Fix storage routing for local mounts in namespaces to prevent metadata replication and ensure GDPR compliance.
  • secrets/pki: Fix PKI certificate issuance not_after time to respect max TTL.
  • secrets/transit: Add managed key support to Transit rewrap endpoint.
  • storage/raft: reject performance_multiplier values less than or equal to zero
]]>https://forum.cloudron.io/post/125866https://forum.cloudron.io/post/125866Thu, 18 Jun 2026 07:08:03 GMT<![CDATA[Reply to Vault - Package Updates on Sat, 06 Jun 2026 07:59:10 GMT]]>[1.83.3]

  • Update vault to 2.0.2
  • Full Changelog
  • containers: Remove cap_ipc_lock capability on vault at build time to allow running Vault in common container runtimes. Vault in containers will no longer be able to call mlock() to lock memory. Operators should set disable_mlock = true in Vault's configuration. Runtime operators are advised to disable swapping to guarantee data safety.
  • secrets/ssh: RSA key sizes are now limited to a maximum size of 8192 bits addressing CVE-2026-39829
  • plugins: Fix plugin signature verification failure with expired pgp key when registering a plugin.
  • ui/transit: Fix key version dropdown selected state when editing a transit key.
]]>https://forum.cloudron.io/post/125555https://forum.cloudron.io/post/125555Sat, 06 Jun 2026 07:59:10 GMT<![CDATA[Reply to Vault - Package Updates on Wed, 20 May 2026 09:50:44 GMT]]>[1.83.2]

  • Update vault to 2.0.1
]]>https://forum.cloudron.io/post/124909https://forum.cloudron.io/post/124909Wed, 20 May 2026 09:50:44 GMT<![CDATA[Reply to Vault - Package Updates on Wed, 13 May 2026 10:38:48 GMT]]>[1.83.1]

  • fix: update doc links from /apps/ to /packages/
]]>https://forum.cloudron.io/post/124682https://forum.cloudron.io/post/124682Wed, 13 May 2026 10:38:48 GMT<![CDATA[Reply to Vault - Package Updates on Wed, 15 Apr 2026 05:53:13 GMT]]>[1.83.0]

  • Update vault to 2.0.0
  • Full Changelog
  • PKI External CA (Enterprise): A new plugin that provides the ability to acquire PKI certificates from Public CA providers through the ACME protocol
  • IBM PAO License Integration: Added IBM PAO license support, allowing usage of Vault Enterprise with an IBM PAO license key.
  • A new configuration stanza license_entitlement is required in the Vault config to use an IBM license. For more details, see
  • the License documentation.
  • KMIP Bring Your Own CA: Add new API to manage multiple CAs for client verification and make it possible to import external CAs.
  • LDAP Secrets Engine Enterprise Plugin: Add the new LDAP Secrets Engine Enterprise plugin. This enterprise version adds support for self-managed static roles and Rotation Manager support for automatic static role rotation. New plugin configurations can be set as "self managed", skipping the requirement for a bindpass field and allowing static roles to use their own password to rotate their credential. Automated static role credential rotation supports fine-grained scheduled rotations and retry policies through Vault Enterprise.
  • Login MFA TOTP Self-Enrollment (Enterprise): Simplify creation of login MFA TOTP credentials for users, allowing them to self-enroll MFA TOTP using a QR code (TOTP secret) generated during login. The new functionality is configurable on the TOTP login MFA method configuration screen and via the enable_self_enrollment parameter in the API.
  • Plugins (Enterprise): Allow overriding pinned version when creating and updating database engines
  • Plugins (Enterprise): Allow overriding pinned version when enabling and tuning auth and secrets backends
  • Template Integration for PublicPKICA: Vault Agent templates are now automatically re-rendered when a PKI external CA certificate is issued or renewed.
]]>https://forum.cloudron.io/post/123434https://forum.cloudron.io/post/123434Wed, 15 Apr 2026 05:53:13 GMT<![CDATA[Reply to Vault - Package Updates on Wed, 11 Mar 2026 11:25:32 GMT]]>[1.82.5]

  • Fixup doc URL
]]>https://forum.cloudron.io/post/121642https://forum.cloudron.io/post/121642Wed, 11 Mar 2026 11:25:32 GMT<![CDATA[Reply to Vault - Package Updates on Thu, 05 Mar 2026 09:51:50 GMT]]>[1.82.4]

]]>https://forum.cloudron.io/post/121282https://forum.cloudron.io/post/121282Thu, 05 Mar 2026 09:51:50 GMT<![CDATA[Reply to Vault - Package Updates on Thu, 08 Jan 2026 07:52:09 GMT]]>[1.82.2]

  • Update vault to 1.21.2
  • Full Changelog
  • auth/oci: bump plugin to v0.20.1
  • core: Bump Go version to 1.25.5
  • packaging: Container images are now exported using a compressed OCI image layout.
  • packaging: UBI container images are now built on the UBI 10 minimal image.
  • secrets/azure: Update plugin to v0.25.1+ent. Improves retry handling during Azure application and service principal creation to reduce transient failures.
  • storage: Upgrade aerospike client library to v8.
  • core/activitylog (enterprise): Resolve a stability issue where Vault Enterprise could encounter a panic during month-end billing activity rollover.
  • http: skip JSON limit parsing on cluster listener.
  • quotas: Vault now protects plugins with ResolveRole operations from panicking on quota creation.
  • replication (enterprise): fix rare panic due to race when enabling a secondary with Consul storage.
]]>https://forum.cloudron.io/post/118125https://forum.cloudron.io/post/118125Thu, 08 Jan 2026 07:52:09 GMT<![CDATA[Reply to Vault - Package Updates on Thu, 20 Nov 2025 08:36:42 GMT]]>[1.82.1]

]]>https://forum.cloudron.io/post/115681https://forum.cloudron.io/post/115681Thu, 20 Nov 2025 08:36:42 GMT<![CDATA[Reply to Vault - Package Updates on Thu, 23 Oct 2025 06:24:38 GMT]]>[1.82.0]

  • Update vault to 1.21.0
  • Full Changelog
  • auth/ldap: fix MFA/TOTP enforcement bypass when username_as_alias is enabled.
  • activity: Renamed timestamp in export API response to token_creation_time.
  • http: Add JSON configurable limits to HTTP handling for JSON payloads: max_json_depth, max_json_string_value_length, max_json_object_entry_count, max_json_array_element_count.
  • AES-CBC in Transit (Enterprise): Add support for encryption and decryption with AES-CBC in the Transit Secrets Engine.
  • KV v2 Version Attribution: Vault now includes attribution metadata for versioned KV secrets. This allows lookup of attribution information for each version of KV v2 secrets from CLI and API.
  • Login MFA TOTP Self-Enrollment (Enterprise): Simplify creation of login MFA TOTP credentials for users, allowing them to self-enroll MFA TOTP using a QR code (TOTP secret) generated during login. The new functionality is configurable on the TOTP login MFA method configuration screen and via the enable_self_enrollment parameter in the API.
  • activity (enterprise): Fix development_cluster setting being overwritten on performance secondaries upon cluster reload.
  • auth/cert: Recover from partially populated caches of trusted certificates if one or more certificates fails to load.
  • auth/spiffe: Address an issue updating a role with overlapping workload_id_pattern values it previously contained.
  • core: Role based quotas now work for cert auth
]]>https://forum.cloudron.io/post/114318https://forum.cloudron.io/post/114318Thu, 23 Oct 2025 06:24:38 GMT<![CDATA[Reply to Vault - Package Updates on Thu, 25 Sep 2025 06:45:22 GMT]]>[1.81.4]

  • Update vault to 1.20.4
  • Full Changelog
  • core: Update github.com/ulikunitz/xz to fix security vulnerability GHSA-25xm-hr59-7c27. (ce4b4264)
  • database/snowflake: Update plugin to v0.14.2 (9f06df77)
  • Raft: Auto-join will now allow you to enforce IPv4 on networks that allow IPv6 and dual-stack enablement, which is on by default in certain regions. (1fd38796)
  • auth/cert: Support RFC 9440 colon-wrapped Base64 certificates in x_forwarded_for_client_cert_header, to fix TLS certificate auth errors with Google Cloud Application Load Balancer. [GH-31501]
  • secrets/database (enterprise): Add support for reading, listing, and recovering static roles from a loaded snapshot. Also add support for reading static credentials from a loaded snapshot. (24cd1aa5)
  • secrets/ssh: Add support for recovering the SSH plugin CA from a loaded snapshot (enterprise only). (0087af9d)
  • auth/cert: Recover from partially populated caches of trusted certificates if one or more certificates fails to load. [GH-31438]
  • core: Role based quotas now work for cert auth (fc775dea)
  • sys/mounts: enable unsetting allowed_response_headers [GH-31555]
  • ui: Fix page loading error when users navigate away from identity entities and groups list views. (81170963)
]]>https://forum.cloudron.io/post/112956https://forum.cloudron.io/post/112956Thu, 25 Sep 2025 06:45:22 GMT<![CDATA[Reply to Vault - Package Updates on Fri, 29 Aug 2025 07:34:17 GMT]]>[1.81.3]

  • Update vault to 1.20.3
  • Full Changelog
  • core: Bump Go version to 1.24.6. (ce56e14e)
  • http: Add JSON configurable limits to HTTP handling for JSON payloads: max_json_depth, max_json_string_value_length, max_json_object_entry_count, max_json_array_element_count. [GH-31069]
  • sdk: Upgrade to go-secure-stdlib/plugincontainer@v0.4.2, which also bumps github.com/docker/docker to v28.3.3+incompatible (8f172169)
  • secrets/openldap (enterprise): update plugin to v0.16.1
  • auth/ldap: add explicit logging to rotations in ldap [GH-31401]
  • core (enterprise): improve rotation manager logging to include specific lines for rotation success and failure
  • secrets/database: log password rotation success (info) and failure (error). Some relevant log lines have been updated to include "path" fields. [GH-31402]
  • secrets/transit: add logging on both success and failure of key rotation [GH-31420]
  • ui: Use the Helios Design System Code Block component for all readonly code editors and use its Code Editor component for all other code editors [GH-30188]
  • core (enterprise): fix a bug where issuing a token in a namespace used root auth configuration instead of namespace auth configuration
]]>https://forum.cloudron.io/post/112158https://forum.cloudron.io/post/112158Fri, 29 Aug 2025 07:34:17 GMT<![CDATA[Reply to Vault - Package Updates on Thu, 07 Aug 2025 08:10:31 GMT]]>[1.81.2]

  • Update vault to 1.20.2
  • Full Changelog
  • auth/ldap: fix MFA/TOTP enforcement bypass when username_as_alias is enabled [GH-31427,HCSEC-2025-20].
  • agent/template: Fixed issue where templates would not render correctly if namespaces was provided by config, and the namespace and mount path of the secret were the same. [GH-31392]
  • identity/mfa: revert cache entry change from #​31217 and document cache entry values [GH-31421]
]]>https://forum.cloudron.io/post/111344https://forum.cloudron.io/post/111344Thu, 07 Aug 2025 08:10:31 GMT<![CDATA[Reply to Vault - Package Updates on Fri, 25 Jul 2025 12:56:36 GMT]]>[1.81.1]

]]>https://forum.cloudron.io/post/110682https://forum.cloudron.io/post/110682Fri, 25 Jul 2025 12:56:36 GMT<![CDATA[Reply to Vault - Package Updates on Fri, 27 Jun 2025 13:22:50 GMT]]>[1.81.0]

  • Update vault to 1.20.0
  • Full Changelog
  • core: require a nonce when cancelling a rekey operation that was initiated within the last 10 minutes. [GH-30794],[HCSEC-2025-11]
  • UI: remove outdated and unneeded js string extensions [GH-29834]
  • activity (enterprise): The sys/internal/counters/activity endpoint will return actual values for new clients in the current month.
  • activity (enterprise): provided values for start_time and end_time in sys/internal/counters/activity are aligned to the corresponding billing period.
  • activity: provided value for end_time in sys/internal/counters/activity is now capped at the end of the last completed month. [GH-30164]
  • api: Update the default API client to check for the Retry-After header and, if it exists, wait for the specified duration before retrying the request. [GH-30887]
  • auth/alicloud: Update plugin to v0.21.0 [GH-30810]
  • auth/azure: Update plugin to v0.20.2. Login requires resource_group_name, vm_name, and vmss_name to match token claims [GH-30052]
  • auth/azure: Update plugin to v0.20.3 [GH-30082]
  • auth/azure: Update plugin to v0.20.4 [GH-30543]
]]>https://forum.cloudron.io/post/109373https://forum.cloudron.io/post/109373Fri, 27 Jun 2025 13:22:50 GMT<![CDATA[Reply to Vault - Package Updates on Fri, 30 May 2025 18:38:10 GMT]]>[1.80.5]

]]>https://forum.cloudron.io/post/107926https://forum.cloudron.io/post/107926Fri, 30 May 2025 18:38:10 GMT<![CDATA[Reply to Vault - Package Updates on Sat, 17 May 2025 07:24:03 GMT]]>[1.80.4]

  • Update vault to 1.19.4
  • Full Changelog
  • Update vault-plugin-auth-cf to v0.20.1 GH-30586]
  • auth/azure: Update plugin to v0.20.4 GH-30543]
  • core: Bump Go version to 1.24.3.
  • Namespaces (enterprise): allow a root token to relock a namespace
  • core (enterprise): update to FIPS 140-3 cryptographic module in the FIPS builds.
  • core: Updated code and documentation to support FIPS 140-3 compliant algorithms. GH-30576]
  • core: support for X25519MLKEM768 (post quantum key agreement) in the Go TLS stack. GH-30603]
  • ui: Replaces all instances of the deprecated event.keyCode with event.key GH-30493]
  • core (enterprise): fix a bug where plugin automated root rotations would stop after seal/unseal operations
  • plugins (enterprise): Fix an issue where Enterprise plugins can't run on a standby node when it becomes active because standby nodes don't extract the artifact when the plugin is registered. Remove extracting from Vault and require the operator to place the extracted artifact in the plugin directory before registration.
]]>https://forum.cloudron.io/post/107269https://forum.cloudron.io/post/107269Sat, 17 May 2025 07:24:03 GMT<![CDATA[Reply to Vault - Package Updates on Thu, 01 May 2025 07:58:14 GMT]]>[1.80.3]

]]>https://forum.cloudron.io/post/106491https://forum.cloudron.io/post/106491Thu, 01 May 2025 07:58:14 GMT<![CDATA[Reply to Vault - Package Updates on Sat, 19 Apr 2025 08:09:49 GMT]]>[1.80.2]

  • Update vault to 1.19.2
  • Full Changelog
  • core: Bump Go version to 1.23.8
  • secrets/openldap: Update plugin to v0.15.4 [GH-30279]
  • secrets/openldap: Prevent static role rotation on upgrade when NextVaultRotation is nil. Fixes an issue where static roles were unexpectedly rotated after upgrade due to a missing NextVaultRotation value. Now sets it to either LastVaultRotation + RotationPeriod or now + RotationPeriod. [GH-30265]
  • secrets/pki (enterprise): Address a parsing bug that rejected CMPv2 requests containing a validity field.
  • secrets/pki: fix a bug where key_usage was ignored when generating root certificates, and signing certain intermediate certificates. [GH-30034]
  • secrets/transit: fix a panic when rotating on a managed key returns an error [GH-30214]
]]>https://forum.cloudron.io/post/105956https://forum.cloudron.io/post/105956Sat, 19 Apr 2025 08:09:49 GMT<![CDATA[Reply to Vault - Package Updates on Fri, 04 Apr 2025 16:43:10 GMT]]>[1.80.1]

]]>https://forum.cloudron.io/post/105182https://forum.cloudron.io/post/105182Fri, 04 Apr 2025 16:43:10 GMT<![CDATA[Reply to Vault - Package Updates on Thu, 06 Mar 2025 08:06:02 GMT]]>[1.80.0]

  • Update base image to 5.0.0
]]>https://forum.cloudron.io/post/102685https://forum.cloudron.io/post/102685Thu, 06 Mar 2025 08:06:02 GMT<![CDATA[Reply to Vault - Package Updates on Thu, 06 Mar 2025 07:56:11 GMT]]>[1.17.0]

  • Update vault to 1.19.0
  • Full Changelog
  • raft/snapshotagent (enterprise): upgrade raft-snapshotagent to v0.0.0-20241115202008-166203013d8e
  • raft/snapshotagent (enterprise): upgrade raft-snapshotagent to v0.2.0
  • api: Add to sys/health whether the node has been removed from the HA cluster. If the node has been removed, return code 530 by default or the value of the removedcode query parameter. [GH-28991]
  • api: Add to sys/health whether the standby node has been able to successfully send heartbeats to the active node and the time in milliseconds since the last heartbeat. If the standby has been unable to send a heartbeat, return code 474 by default or the value of the haunhealthycode query parameter. [GH-28991]
  • auth/alicloud: Update plugin to v0.20.0 [GH-29613]
]]>https://forum.cloudron.io/post/102682https://forum.cloudron.io/post/102682Thu, 06 Mar 2025 07:56:11 GMT