Vault - Package Updates

[Package Updates]

[1.83.5]

• Update vault to 2.0.4
• Full Changelog
• containers: The following packages have been removed from UBI based container images: gnupg, openssl, procps.
• acl: Fix privilege-escalation vulnerability where a denied_parameters constraint on the policies request field could be bypassed by submitting a mixed-case policy name (e.g. "Super-Admin" instead of "super-admin"). Vault now normalizes the policies parameter to lowercase before evaluating allowed_parameters/denied_parameters constraints.
• core: remove support for duplicate attributes in HCL configuration files and policy definitions. Parsing HCL with duplicate attributes now always fails, and the VAULT_ALLOW_PENDING_REMOVAL_DUPLICATE_HCL_ATTRIBUTES environment variable that previously restored the legacy behavior has been removed.
• secrets: Added ability to view secrets in YAML format
• auth/cert: Support login via x-forwarded cert headers even with tls disabled on the vault listener.
• Proxy/Agent: Fixed a bug where auth method headers accumulated on the shared API client across re-auth cycles.
• audit: Fix a regression from CVE-2025-6000 that broke enabling audit devices on Windows when a plugin directory was configured.
• auth/cert: Add support for x-forwarded cert headers coming from AWS ALBs.
• core: Preserve URL query parameters when redirecting API requests containing duplicate slashes to their canonical path. Previously, the redirect dropped parameters such as ?list=true, potentially changing the result of the request.
• secrets-sync: Fix GCP Secret Manager destinations losing their per-region KMS key on Vault restart.

[Package Updates]

[1.84.0]

• Update vault to 2.1.0
• Full Changelog
• core: Update go.etcd.io/etcd/client/pkg/v3 to v3.7.1 to fix security vulnerability GO-2026-6107.
• core: Update software.sslmate.com/src/go-pkcs12 to v0.7.2 to fix security vulnerability GO-2026-5052.
• Agent Registry UI (enterprise): Adds a new Agentic Security section to the primary navigation with an Agent Registry page where operators can view, search, and manage registered AI agents, their associated Vault entities and aliases, assigned policies, and operational status.
• Automatic DNS-01 Challenge Fulfillment for PKI External CA: Integrate with the following DNS providers for automatic DNS-01 challenge fulfillment: AWS Route53, Azure DNS, Google Cloud DNS, and BIND and other RFC2136-compliant servers.
• PKI PKCS#12 and JKS Support: Adds support for PKCS#12 (PFX) and Java keytool (JKS) certificate bundles to relevant PKI endpoints. Bundles are returned as base64-encoded, password-protected files.
• SLH-DSA support for Hybrid sign/verify in Transit engine (enterprise): Add support for SLH-DSA as the PQC component for Hybrid sign/verify operations. This is compatible with both ECDSA (p-256, P-384, P-521) and Ed25519.
• agent/pki-external-ca: Fix CA chain extraction from Vault PKI API responses where ca_chain field was always empty in templates due to incorrect type handling of array responses
• api: Account for the HTTP Age header when calculating a lease's remaining lifetime, so that leases read or renewed through a caching proxy such as Vault Agent are renewed before they expire.
• core/login: Fix panic on malformed login requests. Vault now returns an error for malformed login payloads instead of dropping the client connection (no data loss).
• secrets/database: Sanitize the caller-controlled DisplayName before it is used in generated usernames to prevent SQL injection via username templates. Adds a configuration warning when a username_template references DisplayName without a truncate function.

[Package Updates]

[1.84.1]

• Update vault to 2.1.1
• Full Changelog

[Package Updates]

[1.84.2]

• Update vault to 2.1.2
• Full Changelog

[Package Updates]

[1.85.0]

• Update vault to 2.2.0
• Full Changelog
• containers: Remove cap_ipc_lock capability on vault at build time to allow running Vault in common container runtimes. Vault in containers will no longer be able to call mlock() to lock memory. Operators should set disable_mlock = true in Vault's configuration. Runtime operators are advised to disable swapping to guarantee data safety.
• physical/postgresql: breaking change - PostgreSQL storage backend authentication now prefers Azure Workload Identity over Managed Identity. Update go-pgmultiauth to v1.1.0. Existing Managed Identity-based PostgreSQL configurations may stop working if Workload Identity is configured. Affected users must migrate PostgreSQL authentication to Workload Identity.
• pki: ACME finalization with the default sign-verbatim directory policy now rejects CSRs that contain URI SANs, email SANs, or Other SANs. ACME challenges only verify DNS names and IP addresses; those SAN types are never validated and must not appear in issued certificates. Operators who require the previous behaviour can set default_directory_policy = "sign-verbatim-unsafe" in config/acme, accepting that the resulting certificates may contain unverified identity claims.
• AI Agent Support (Enterprise): Vault's support for first-class AI agents is now Generally Available. Adds an Agent Registry to register agents, and adds support for using Vault as an OAuth resource server for registered agent entities. When configured, allows OAuth 2.0 JWTs to be used to directly authorize requests to Vault, without needing a Vault token.
• Automatic TLS Certificate Reloading: TCP listeners accept a new tls_reload_interval option. When set, Vault periodically checks tls_cert_file and tls_key_file for changes and reloads the certificate automatically, so rotated certificates are picked up without restarting the node or sending SIGHUP.
• ML-DSA Support in PKI: Add support for post-quantum signatures with ML-DSA keys in the PKI secrets engine.
• PKI PKCS#12 and JKS Support: Adds support for PKCS#12 (PFX) and Java keytool (JKS) certificate bundles to relevant PKI endpoints. Bundles are returned as base64-encoded, password-protected files.
• Proxy/Agent: Fixed a bug where auth method headers accumulated on the shared API client across re-auth cycles.
• auth/aws: Fix an issue where a user may be able to bypass authentication to Vault due to incorrect caching of the AWS client
• core/acl: Fix LIST ACL bypass where a trailing-slash request could skip a more-specific deny rule.