⟳ Updates Hub
O
Home / Security

OpenBao

Website ↗ RSS 32 items Fetched 39m ago
O
OpenBao Security v2.7.2

v2.7.2

SECURITY auth/cert: Add resolve path canonicalization to CRL paths. GHSA-736f-82w7-hj22. [GH-4323] secrets/approle: Add resolve path canonicalization in Role ID paths. GHSA-736f-82w7-hj22. [GH-4323] secrets/identity: Ensure client_type=public is denied with client_credentials=true in the OIDC provider. GHSA-q824-44ff-f5j5. [GH-4323] secrets/ssh: Deny wildcards (*) in SSH certificate identity templ…

O
OpenBao Security v2.6.5

v2.6.5

SECURITY auth/cert: Add resolve path canonicalization to CRL paths. GHSA-736f-82w7-hj22. [GH-4325] auth/ldap: Add resolve path canonicalization to user, group paths. GHSA-736f-82w7-hj22. [GH-4325] auth/radius: Add resolve path canonicalization to user paths. GHSA-736f-82w7-hj22. [GH-4325] secrets/approle: Add resolve path canonicalization in Role ID paths. GHSA-736f-82w7-hj22. [GH-4325] secrets/id…

O
OpenBao Security v2.7.1

v2.7.1

SECURITY core: Prevent disclosure of tls_acme_eab_mac_key from sys/config/state/sanitized. GHSA-3237-j65r-m5rp. [GH-4148] core/audit: The unauthenticated "Root Token Generation" and "Rekey" endpoints (which are disabled by default) returned their response, even if audit logging failed. GHSA-q74w-hv5x-6hxf. [GH-4148] auth/approle: Ensure Secret ID cannot be used for authentication after expiration…

O
OpenBao Security v2.6.4

v2.6.4

SECURITY core: Prevent disclosure of tls_acme_eab_mac_key from sys/config/state/sanitized. GHSA-3237-j65r-m5rp. [GH-4148] core/audit: The unauthenticated "Root Token Generation" and "Rekey" endpoints (which are disabled by default) returned their response, even if audit logging failed. GHSA-q74w-hv5x-6hxf. [GH-4148] auth/approle: Ensure Secret ID cannot be used for authentication after expiration…

O
OpenBao Security v2.7.0

v2.7.0

SECURITY agent, proxy: Ensure the quit endpoint correctly requires the X-Vault-Request header when specified by listener configuration. GHSA-8gmq-wv9h-fcwp. [GH-4065] auth/cert, auth/kubernetes, auth/userpass, secrets/pki, core/policies, core/workflows: Use ResolvePathOperation to define canonical URLs for canonicalized resources. GHSA-fg5x-7whg-6c28. [GH-4065] core/plugins: Ensure plugin command…

O
OpenBao Security v2.6.3

v2.6.3

SECURITY agent, proxy: Ensure the quit endpoint correctly requires the X-Vault-Request header when specified by listener configuration. GHSA-8gmq-wv9h-fcwp. [GH-4065] auth/cert, auth/kubernetes, auth/userpass, secrets/pki, core/policies, core/workflows: Use ResolvePathOperation to define canonical URLs for canonicalized resources. GHSA-fg5x-7whg-6c28. [GH-4065] core/plugins: Ensure plugin command…

O
OpenBao Security v2.7.0-beta20260909

v2.7.0-beta20260909

FEATURES External Keys: The PKI and Transit secret engines can now use KMS plugins to perform cryptographic operations without storing key material in OpenBao. [GH-3956] Configure mappings to HSM or KMS-backed keys via the /sys/external-keys APIs and grant access to select mounts. Use the PKI engine to sign certificates &co with external private keys. Use the Transit engine to sign, verify, encryp…

O
OpenBao Security v2.6.2

v2.6.2

SECURITY core: Ensure internal operation types cannot be dispatched from inline authentication and workflows, preventing token creation. GHSA-rh46-vc3j-w2w3. [GH-3831] secrets/pki: Also enforce allowed_ip_sans_cidr on IP SANs from CSRs. GHSA-g892-p242-8g86. [GH-3833] BUG FIXES command/agent: Fix file sink chown failing unconditionally on Windows. [GH-3733] core: Prevent recovered panic in request…

O
OpenBao Security v2.6.1

v2.6.1

CHANGES packaging/container: Revert removal of legacy, non-opencontainers image labels for maximum compatibility. [GH-3504] IMPROVEMENTS core: Warn on sys/ key with no explicit invalidation handler; please report if you see a log line with no mechanism to invalidate cache. [GH-3555] core/policies: Introduce PATCH operation support for modifying the values of specific parameters. [GH-3506] BUG FIXE…

O
OpenBao Security v2.6.0

v2.6.0

FEATURES Namespace Sealing: Allow Shamir seal configuration on namespace creation. [GH-3297] Partitions tenant storage with distinct cryptographic key material. Allows tenants to revoke access to their namespace via seal operation without impacting other tenants. Uses global synchronization of namespace seal status, allowing easier management from multi-node deployments. Auto Unseal plugins: Add a…

O
OpenBao Security v2.6.0-beta20260622

v2.6.0-beta20260622

FEATURES Namespace Sealing: Allow Shamir seal configuration on namespace creation. [GH-3297] Partitions tenant storage with distinct cryptographic key material. Allows tenants to revoke access to their namespace via seal operation without impacting other tenants. Uses global synchronization of namespace seal status, allowing easier management from multi-node deployments. Auto Unseal plugins: Add a…