- The changelog provided contains no substantive information about changes in this release—it only references an automated build process for artifacts.
advisories
Vault
tool19 releases · 12 support linesSupport lines
LTS status and end of life
| Line | Latest | Status | End of life |
|---|---|---|---|
| 2.0 | 2.0.4 | supported | — |
| 1.21 | 1.21.4 | eol | 13 Apr 2026 |
| 1.20 | 1.20.4 | eol | 21 Oct 2025 |
| 1.19 | 1.19.5 | ltseol | 23 Jun 2025 |
| 1.18 | 1.18.5 | eol | 4 Mar 2025 |
| 1.17 | 1.17.6 | eol | 9 Oct 2024 |
| 1.16 | 1.16.3 | ltseol | 10 Jun 2024 |
| 1.15 | 1.15.6 | eol | 8 Oct 2024 |
| 1.14 | 1.14.10 | eol | 10 Jun 2024 |
| 1.13 | 1.13.13 | eol | 25 Mar 2024 |
| 1.12 | 1.12.11 | eol | 27 Sep 2023 |
| 1.11 | 1.11.12 | eol | 21 Jun 2023 |
Releases
newest first
changelog ↗
- Fixed a LIST ACL bypass where trailing-slash requests could skip more-specific deny rules, which may now deny requests that were previously allowed
- Added case-insensitive username handling in RADIUS auth to prevent collisions
- Vault now redirects non-canonicalized paths (containing /./, /../, or //) to cleaned paths instead of rejecting them
- Added beta AI Agent support (Enterprise) with agent registry and OAuth 2.0 JWT authorization
what breaks
Policies relying on the previous incorrect LIST ACL behavior may now deny requests that were previously allowed. Specifically, a deny on path "kv/*" will now correctly block LIST requests to "kv/private/" even if a broader allow path "kv/*" exists.
- Vault containers no longer have the cap_ipc_lock capability, preventing memory locking via mlock(); operators must set disable_mlock = true and disable swapping
- RSA key sizes are now limited to a maximum of 8192 bits to address a security vulnerability
- Fixed plugin signature verification failures when PGP keys are expired
- Fixed transit key version dropdown selection state in the UI
what breaks
Container operators: Vault can no longer call mlock() to lock memory in containers. You must set disable_mlock = true in your configuration and disable swapping at the runtime level to maintain data safety. SSH secret engine users: RSA keys larger than 8192 bits are no longer supported.
to upgrade
Set disable_mlock = true in Vault's configuration if running Vault in containers. Disable swapping at the runtime level to guarantee data safety. Review any RSA keys larger than 8192 bits in your SSH secret engine and regenerate them if needed.
advisories
- Multiple security vulnerabilities fixed including updates to golang.org/x/net, Azure NTLMSSP, Apache Thrift, and PostgreSQL driver dependencies
- Container runtimes must now add IPC_LOCK capabilities when running the Vault container
- New billing metrics dashboard and expanded consumption billing tracking for additional token and certificate types
- Secrets Sync UI now supports Workload Identity Federation for AWS, Azure, and GCP destinations
what breaks
Container runtimes will need to add IPC_LOCK capabilities when running the Vault container due to cap_ipc_lock capability being set at build time.
to upgrade
Container runtimes must add IPC_LOCK capabilities when running the Vault container.
- Multiple security vulnerabilities fixed across dependencies (go-jose, circl, pgx, aws-sdk, otel, and others) and core authentication/authorization logic
- Breaking change: Docker helpers migrated from github.com/docker/docker to github.com/moby/moby due to upstream maintenance issues
- New features added including PKI External CA plugin, LDAP Secrets Engine Enterprise, SCIM 2.0 identity provisioning (beta), and Vault Agent ACME support
- Numerous plugin updates, UI improvements, and bug fixes across auth methods, secrets engines, and core functionality
what breaks
SDK docker helpers migrated from github.com/docker/docker to github.com/moby/moby. This affects anyone using the docker helpers from the Vault SDK. Additionally, sys/generate-root, sys/replication/dr/secondary/generate-operation-token, and sys/rekey endpoints now require authentication by default (previously unauthenticated); old behavior can be restored via enable_unauthenticated_access config. Vault now rejects non-canonical paths (e.g., paths with double slashes). The managed-keys API response format changed from integer to string values for key usages.
to upgrade
To restore previous unauthenticated behavior for generate-root, generate-operation-token, or rekey endpoints, set the enable_unauthenticated_access HCL config key to include the relevant values. Review any code using docker helpers from the SDK and update to use github.com/moby/moby. Ensure application paths are canonical (no double slashes). If using managed-keys, update code expecting integer key usage values to handle string values instead.
Summary pending.
changelog ↗No changelog text published for this release.
changelog ↗No changelog text published for this release.
changelog ↗No changelog text published for this release.
changelog ↗No changelog text published for this release.
changelog ↗No changelog text published for this release.
changelog ↗No changelog text published for this release.
changelog ↗No changelog text published for this release.
changelog ↗No changelog text published for this release.
changelog ↗No changelog text published for this release.
changelog ↗No changelog text published for this release.
changelog ↗No changelog text published for this release.
changelog ↗No changelog text published for this release.
changelog ↗No changelog text published for this release.
changelog ↗