⟳ Updates Hub
O
Home / Security

OpenBao

Website ↗ RSS 23 items Fetched 10m ago
O
OpenBao Security v2.7.0-beta20260909

v2.7.0-beta20260909

FEATURES External Keys: The PKI and Transit secret engines can now use KMS plugins to perform cryptographic operations without storing key material in OpenBao. [GH-3956] Configure mappings to HSM or KMS-backed keys via the /sys/external-keys APIs and grant access to select mounts. Use the PKI engine to sign certificates &co with external private keys. Use the Transit engine to sign, verify, encryp…

O
OpenBao Security v2.6.2

v2.6.2

SECURITY core: Ensure internal operation types cannot be dispatched from inline authentication and workflows, preventing token creation. GHSA-rh46-vc3j-w2w3. [GH-3831] secrets/pki: Also enforce allowed_ip_sans_cidr on IP SANs from CSRs. GHSA-g892-p242-8g86. [GH-3833] BUG FIXES command/agent: Fix file sink chown failing unconditionally on Windows. [GH-3733] core: Prevent recovered panic in request…

O
OpenBao Security v2.6.1

v2.6.1

CHANGES packaging/container: Revert removal of legacy, non-opencontainers image labels for maximum compatibility. [GH-3504] IMPROVEMENTS core: Warn on sys/ key with no explicit invalidation handler; please report if you see a log line with no mechanism to invalidate cache. [GH-3555] core/policies: Introduce PATCH operation support for modifying the values of specific parameters. [GH-3506] BUG FIXE…

O
OpenBao Security v2.6.0

v2.6.0

FEATURES Namespace Sealing: Allow Shamir seal configuration on namespace creation. [GH-3297] Partitions tenant storage with distinct cryptographic key material. Allows tenants to revoke access to their namespace via seal operation without impacting other tenants. Uses global synchronization of namespace seal status, allowing easier management from multi-node deployments. Auto Unseal plugins: Add a…

O
OpenBao Security v2.6.0-beta20260622

v2.6.0-beta20260622

FEATURES Namespace Sealing: Allow Shamir seal configuration on namespace creation. [GH-3297] Partitions tenant storage with distinct cryptographic key material. Allows tenants to revoke access to their namespace via seal operation without impacting other tenants. Uses global synchronization of namespace seal status, allowing easier management from multi-node deployments. Auto Unseal plugins: Add a…

O
OpenBao Security v2.5.5

v2.5.5

SECURITY auth/ldap: Prevent unlikely post-bind LDAP injection via bind DN to group resolution. GHSA-6mwx-4547-5vc9. [GH-3306] secrets/ldap: Prevent potential LDAP injection with unsanitized DNs for service accounts. GHSA-6mwx-4547-5vc9. [GH-3306] secrets/transit: Prevent server crash due to unlock of unlocked mutex for RSA keys created with derived=true. GHSA-8w8f-r2xv-4q4j. [GH-3309] core/leases:…

O
OpenBao Security v2.5.4

v2.5.4

SECURITY core/auth: Fix audit logs dropping custom headers when using inline auth. GHSA-q8cj-789h-vg24 / CVE-2026-46358. [GH-3076] core: Prevent hidden default token issuance from auth plugin endpoints returning both a logical.Auth{} response object and an error. GHSA-7j6w-vvw2-5f9c / CVE-2026-46405. [GH-3150] core: Remove legacy lease endpoints (sys/revoke, sys/renew, sys/revoke-prefix, and sys/r…