Vault - Package Updates

[Package Updates]

[1.83.5]

• Update vault to 2.0.4
• Full Changelog
• containers: The following packages have been removed from UBI based container images: gnupg, openssl, procps.
• acl: Fix privilege-escalation vulnerability where a denied_parameters constraint on the policies request field could be bypassed by submitting a mixed-case policy name (e.g. "Super-Admin" instead of "super-admin"). Vault now normalizes the policies parameter to lowercase before evaluating allowed_parameters/denied_parameters constraints.
• core: remove support for duplicate attributes in HCL configuration files and policy definitions. Parsing HCL with duplicate attributes now always fails, and the VAULT_ALLOW_PENDING_REMOVAL_DUPLICATE_HCL_ATTRIBUTES environment variable that previously restored the legacy behavior has been removed.
• secrets: Added ability to view secrets in YAML format
• auth/cert: Support login via x-forwarded cert headers even with tls disabled on the vault listener.
• Proxy/Agent: Fixed a bug where auth method headers accumulated on the shared API client across re-auth cycles.
• audit: Fix a regression from CVE-2025-6000 that broke enabling audit devices on Windows when a plugin directory was configured.
• auth/cert: Add support for x-forwarded cert headers coming from AWS ALBs.
• core: Preserve URL query parameters when redirecting API requests containing duplicate slashes to their canonical path. Previously, the redirect dropped parameters such as ?list=true, potentially changing the result of the request.
• secrets-sync: Fix GCP Secret Manager destinations losing their per-region KMS key on Vault restart.

[Package Updates]

[1.84.0]

• Update vault to 2.1.0
• Full Changelog
• core: Update go.etcd.io/etcd/client/pkg/v3 to v3.7.1 to fix security vulnerability GO-2026-6107.
• core: Update software.sslmate.com/src/go-pkcs12 to v0.7.2 to fix security vulnerability GO-2026-5052.
• Agent Registry UI (enterprise): Adds a new Agentic Security section to the primary navigation with an Agent Registry page where operators can view, search, and manage registered AI agents, their associated Vault entities and aliases, assigned policies, and operational status.
• Automatic DNS-01 Challenge Fulfillment for PKI External CA: Integrate with the following DNS providers for automatic DNS-01 challenge fulfillment: AWS Route53, Azure DNS, Google Cloud DNS, and BIND and other RFC2136-compliant servers.
• PKI PKCS#12 and JKS Support: Adds support for PKCS#12 (PFX) and Java keytool (JKS) certificate bundles to relevant PKI endpoints. Bundles are returned as base64-encoded, password-protected files.
• SLH-DSA support for Hybrid sign/verify in Transit engine (enterprise): Add support for SLH-DSA as the PQC component for Hybrid sign/verify operations. This is compatible with both ECDSA (p-256, P-384, P-521) and Ed25519.
• agent/pki-external-ca: Fix CA chain extraction from Vault PKI API responses where ca_chain field was always empty in templates due to incorrect type handling of array responses
• api: Account for the HTTP Age header when calculating a lease's remaining lifetime, so that leases read or renewed through a caching proxy such as Vault Agent are renewed before they expire.
• core/login: Fix panic on malformed login requests. Vault now returns an error for malformed login payloads instead of dropping the client connection (no data loss).
• secrets/database: Sanitize the caller-controlled DisplayName before it is used in generated usernames to prevent SQL injection via username templates. Adds a configuration warning when a username_template references DisplayName without a truncate function.