⟳ Updates Hub
O
Home / Security

OpenBao

Website ↗ RSS 30 items Fetched 2h ago
O
OpenBao Security v2.7.1

v2.7.1

SECURITY core: Prevent disclosure of tls_acme_eab_mac_key from sys/config/state/sanitized. GHSA-3237-j65r-m5rp. [GH-4148] core/audit: The unauthenticated "Root Token Generation" and "Rekey" endpoints (which are disabled by default) returned their response, even if audit logging failed. GHSA-q74w-hv5x-6hxf. [GH-4148] auth/approle: Ensure Secret ID cannot be used for authentication after expiration…

O
OpenBao Security v2.6.4

v2.6.4

SECURITY core: Prevent disclosure of tls_acme_eab_mac_key from sys/config/state/sanitized. GHSA-3237-j65r-m5rp. [GH-4148] core/audit: The unauthenticated "Root Token Generation" and "Rekey" endpoints (which are disabled by default) returned their response, even if audit logging failed. GHSA-q74w-hv5x-6hxf. [GH-4148] auth/approle: Ensure Secret ID cannot be used for authentication after expiration…

O
OpenBao Security v2.7.0

v2.7.0

SECURITY agent, proxy: Ensure the quit endpoint correctly requires the X-Vault-Request header when specified by listener configuration. GHSA-8gmq-wv9h-fcwp. [GH-4065] auth/cert, auth/kubernetes, auth/userpass, secrets/pki, core/policies, core/workflows: Use ResolvePathOperation to define canonical URLs for canonicalized resources. GHSA-fg5x-7whg-6c28. [GH-4065] core/plugins: Ensure plugin command…

O
OpenBao Security v2.6.3

v2.6.3

SECURITY agent, proxy: Ensure the quit endpoint correctly requires the X-Vault-Request header when specified by listener configuration. GHSA-8gmq-wv9h-fcwp. [GH-4065] auth/cert, auth/kubernetes, auth/userpass, secrets/pki, core/policies, core/workflows: Use ResolvePathOperation to define canonical URLs for canonicalized resources. GHSA-fg5x-7whg-6c28. [GH-4065] core/plugins: Ensure plugin command…

O
OpenBao Security v2.7.0-beta20260909

v2.7.0-beta20260909

FEATURES External Keys: The PKI and Transit secret engines can now use KMS plugins to perform cryptographic operations without storing key material in OpenBao. [GH-3956] Configure mappings to HSM or KMS-backed keys via the /sys/external-keys APIs and grant access to select mounts. Use the PKI engine to sign certificates &co with external private keys. Use the Transit engine to sign, verify, encryp…

O
OpenBao Security v2.6.2

v2.6.2

SECURITY core: Ensure internal operation types cannot be dispatched from inline authentication and workflows, preventing token creation. GHSA-rh46-vc3j-w2w3. [GH-3831] secrets/pki: Also enforce allowed_ip_sans_cidr on IP SANs from CSRs. GHSA-g892-p242-8g86. [GH-3833] BUG FIXES command/agent: Fix file sink chown failing unconditionally on Windows. [GH-3733] core: Prevent recovered panic in request…

O
OpenBao Security v2.6.1

v2.6.1

CHANGES packaging/container: Revert removal of legacy, non-opencontainers image labels for maximum compatibility. [GH-3504] IMPROVEMENTS core: Warn on sys/ key with no explicit invalidation handler; please report if you see a log line with no mechanism to invalidate cache. [GH-3555] core/policies: Introduce PATCH operation support for modifying the values of specific parameters. [GH-3506] BUG FIXE…

O
OpenBao Security v2.6.0

v2.6.0

FEATURES Namespace Sealing: Allow Shamir seal configuration on namespace creation. [GH-3297] Partitions tenant storage with distinct cryptographic key material. Allows tenants to revoke access to their namespace via seal operation without impacting other tenants. Uses global synchronization of namespace seal status, allowing easier management from multi-node deployments. Auto Unseal plugins: Add a…

O
OpenBao Security v2.6.0-beta20260622

v2.6.0-beta20260622

FEATURES Namespace Sealing: Allow Shamir seal configuration on namespace creation. [GH-3297] Partitions tenant storage with distinct cryptographic key material. Allows tenants to revoke access to their namespace via seal operation without impacting other tenants. Uses global synchronization of namespace seal status, allowing easier management from multi-node deployments. Auto Unseal plugins: Add a…

O
OpenBao Security v2.5.5

v2.5.5

SECURITY auth/ldap: Prevent unlikely post-bind LDAP injection via bind DN to group resolution. GHSA-6mwx-4547-5vc9. [GH-3306] secrets/ldap: Prevent potential LDAP injection with unsanitized DNs for service accounts. GHSA-6mwx-4547-5vc9. [GH-3306] secrets/transit: Prevent server crash due to unlock of unlocked mutex for RSA keys created with derived=true. GHSA-8w8f-r2xv-4q4j. [GH-3309] core/leases:…

O
OpenBao Security v2.5.4

v2.5.4

SECURITY core/auth: Fix audit logs dropping custom headers when using inline auth. GHSA-q8cj-789h-vg24 / CVE-2026-46358. [GH-3076] core: Prevent hidden default token issuance from auth plugin endpoints returning both a logical.Auth{} response object and an error. GHSA-7j6w-vvw2-5f9c / CVE-2026-46405. [GH-3150] core: Remove legacy lease endpoints (sys/revoke, sys/renew, sys/revoke-prefix, and sys/r…