v2.1.2

October 07, 2026

BREAKING CHANGES:

• pki: ACME finalization with the default sign-verbatim directory policy now rejects CSRs that contain URI SANs, email SANs, or Other SANs. ACME challenges only verify DNS names and IP addresses; those SAN types are never validated and must not appear in issued certificates. Operators who require the previous behaviour can set default_directory_policy = "sign-verbatim-unsafe" in config/acme, accepting that the resulting certificates may contain unverified identity claims.

SECURITY:

• core (enterprise): Prevent policy-name canonicalization bypasses in ACL parameter restrictions.
• core/plugin: Fix plugin catalog entries restored from a raft snapshot, written through sys/raw, or replicated being able to run a binary outside plugin_directory.
• core/policy: Harden request-time ACL construction to ignore malformed legacy policy references containing path-navigation segments (. or ..) so traversal-style names are never resolved or applied.
• core: Fixed a bypass of exact-deny ACL policies where case-variant AppRole, AWS, Azure, GCP, Kubernetes, SCEP, or TPM role names, GitHub team or user policy mapping keys, certificate or CRL names, ACL/RGP/EGP policy names, or userpass usernames could evade the deny and be resolved by the backend to the same protected resource. Okta group names, LDAP and RADIUS names on mounts left in their default case-insensitive configuration, and Enterprise SCIM client names (identity/scim/client/<name>, where a case-variant write overwrites the existing client) are not covered by this fix and remain subject to the same bypass; avoid combining a wildcard allow with an exact deny on those mounts and paths.

CHANGES:

• core/plugin: Plugin catalog entries are now checked against plugin_directory whenever they are used, not only at registration. An entry whose command resolves outside the directory, including through a symlink, is refused with plugin command is outside of configured plugin directory, and mounts that use it are skipped at startup while keeping their data. Such plugins must be registered again with their binary inside plugin_directory.
• core/policy: Vault now validates policy names with segment-aware checks. Empty names and names containing . or .. path segments are rejected for new policy writes and assignments, while names containing / and \ remain supported. During request-time ACL construction, legacy traversal-style policy references are not applied (treated as invalid and unresolved), which can reduce effective token permissions. Operators should audit and rename affected policies before upgrading.
• core: ACL and Sentinel EGP rule paths targeting a specific AppRole, AWS, Azure, GCP, Kubernetes, SCEP, or TPM role, GitHub team or user policy mapping key, certificate or CRL name, ACL/RGP/EGP policy name, or userpass username are now matched against the lowercased resource name, since these backends resolve those names case-insensitively. A rule written with a mixed-case resource name (for example auth/approle/role/MyRole) no longer matches requests for that resource and must be rewritten using the lowercase name (auth/approle/role/myrole). The lowercased form is also what Sentinel RGP and EGP policies observe as request.path, so policy rules that compare that value against a mixed-case path (for example request.path is "auth/approle/role/MyRole") must be updated as well. External auth and secret plugins are not affected by this normalization and continue to receive requests with their original casing. Existing deny rules using mixed-case resource names will fail open (become allow-all) after upgrade until rewritten with lowercase names.

IMPROVEMENTS:

• auth/spiffe (enterprise): Add SPIFFE login cli handler.
• secrets/pki: Add extra_subject_names_oids field to roles to allow specifying additional OID subject name components.

BUG FIXES:

• auth/approle: Fix token_bound_cidrs validation when using /128 blocks for role and secret ID
• ui: Fix regression where the client count billing configuration request omitted the root-namespace header, causing 404s on Monitoring > Client Count when viewed from a child namespace