v2.6.0 #3498

cipherboy · 2026-07-14T17:06:32Z

cipherboy
Jul 14, 2026
Maintainer

FEATURES

Namespace Sealing: Allow Shamir seal configuration on namespace creation. [GH-3297]
- Partitions tenant storage with distinct cryptographic key material.
- Allows tenants to revoke access to their namespace via seal operation without impacting other tenants.
- Uses global synchronization of namespace seal status, allowing easier management from multi-node deployments.
Auto Unseal plugins: Add a new kms plugin type that enables Auto Unseal mechanisms to be distributed as external binary plugins. [GH-2586]
- Declaratively register KMS plugins via plugin "kms" "name" { } stanzas in the server configuration, making "name" available as an Auto Unseal mechanism via seal "name" { }.
- KMS plugins automatically restart and recover from crashes, avoiding a full instance restart when a seal reaches a bad state (e.g., via a misbehaving PKCS#11 library).
- Pre-built plugins for many of the seals currently built into OpenBao are available at https://github.com/openbao/openbao-plugins. A plugin-based seal takes priority over a built-in seal if a matching plugin is installed. Note that several provider-specific built-in seals will be removed from OpenBao in v2.7.0 and remain available as external plugins only. Also see the deprecations section of these release notes.
- Develop custom Auto Unseal mechanisms tailored to your use case using the SDK.
Workflows: This adds new endpoints under sys/workflows to allow operators to create workflows and users to execute them.
- Workflows allow the creation of simplified or managed interfaces over OpenBao's standard API.
- Use of the allow_unauthenticated_workflows server configuration value enables unauthenticated execution of workflows; any dispatched requests still require authentication but this can be provided as a request parameter.
- Workflows are built on the common profile engine powering declarative self-initialization and use the same syntax. [GH-2728]
Authenticated root generation: New /sys/generate-root-token endpoints are available as replacements for the deprecated unauthenticated ones. [GH-3041]
Distroless container images: This is a new container image variant based on distroless/static, available as openbao-distroless. The only executable contained in these images is OpenBao itself. [GH-2592]

SECURITY

command/agent: Ensure previously rendered secrets do not appear in stdout on failures. GHSA-444v-8vxr-p36h. [GH-3494]
core/recovery: Use constant-time token comparison in recovery mode. GHSA-34fc-gh42-pj53. [GH-3388]
core/policies: Prevent LIST operations bypassing capabilities = ["deny"] from a more specific wildcard ACL grant. GHSA-xp3c-3jw3-4vcr. [GH-3389]
core/policies: If the value of a template expression contains a + or * character, it will now be rejected by default. Set allow_wildcards_in_identity_templates = true to overwrite. GHSA-59w7-v8rr-pr4p. [GH-3401]
core/policies: If the value of a template expression contains a / character, it will now be rejected by default. Set allow_slashes_in_identity_templates = true to overwrite. GHSA-59w7-v8rr-pr4p. [GH-3401]
secret/pki: If the value of a template expression in allowed_uri_sans_template and allowed_domains contains a * character, it will now be rejected by default. Set allow_globs_in_identity_templates = true to overwrite. GHSA-59w7-v8rr-pr4p. [GH-3401]
secret/ssh: If the value of a template expression in allowed_users or allowed_domains contains a , character, it will now be rejected by default. Set allow_commas_in_identity_templates = true to overwrite. GHSA-59w7-v8rr-pr4p. [GH-3401]

IMPROVEMENTS

command: Allow overriding the location of ~/.vault-token via the BAO_TOKEN_PATH environment variable. [GH-2706]
command/server: Error when unknown keys are present in the declarative self-initialization configuration. [GH-2883]
command/server: Add CEL support to self-initialization, allowing finer control over structuring requests. [GH-2671]
command/server: Add text/template support to self-initialization, allowing templating of values from other requests/responses. [GH-2727]
command/server: Allow conditional execution of self-initialization requests with when keyword. [GH-2739]
command/server: Allow self-initialization stanzas in development server mode. [GH-2463]
command/server: Allow setting headers on declarative self-initialization requests. [GH-2737]
command/agent: Add uid and gid configuration options for the file sink. [GH-2851]
command/agent: SIGHUP now reloads the client TLS configuration. [GH-3038]
command/login: Support Kubernetes service account token authentication via -method=kubernetes with both interactive and non-interactive modes. [GH-1891]
http: Always include full JSON parse and complexity errors in the response instead of hiding it behind a constant error message. [GH-3240]
http: Ensure that passthrough_request_headers can pass the Host header to plugins. [GH-3325]
core: The sys/ backend is now a singleton shared across all namespaces, reducing idle memory usage of the OpenBao instance. [GH-3007]
core/leases: Lease lookup responses will now include path, namespace_path and revoke_error. [GH-1906]
core/listeners: Add a parameter to allow cross-origin requests to include credentials (Access-Control-Allow-Credentials header). [GH-2262]
core/profiles: Canonicalize headers before evaluating request. [GH-3465]
core/profiles: Parse login MFA from request header information. [GH-3465]
seal/azurekeyvault: Support explicitly setting Azure authentication methods and add support for authenticating using Azure managed identities. [GH-2519]
seal/pkcs11: When using public/private key encryption, fall back to finding the public key via the private key's CKA_ID if both key halves did not share the same CKA_LABEL. [GH-3231]
physical/raft: Detect, log, and rollback transactions that have never been committed or rolled-back. If you see the message "transaction was leaked" in your logs, please open an issue. [GH-2185]
physical/raft: Improve snapshot duration while slightly increasing snapshot size. [GH-3061]
physical/raft: Support auto_join via DNS SRV records. [GH-3397]
auth/cert: Add support for X-Tls-Client-Cert, to allow processing of a leaf certificate forwarded from a TLS-terminating reverse proxy. [GH-2080]
auth/jwt: Add new Kubernetes JWT provider that authenticates to the Kubernetes API using a pod's service account token. [GH-2114]
auth/kerberos: Add the decode_pac option in order to improve compatibility with Kerberos systems. [GH-2211]
auth/userpass: Add password_hash field to allow providing a pre-hashed bcrypt password instead of plaintext. [GH-2702]
secrets/pki: Add encode_json and decode_json CEL helpers. [GH-1549]
secrets/totp: Add generated, expire_time, and period fields to code generation response. [GH-2585]
secrets/ssh: Search for public and private key files if -public-key-path and -private-key-path flags aren't given, respectively. [GH-2419]
database/mysql: Add multi-host connection failover support. Connection URLs can now specify multiple hosts (e.g., tcp(host1:3306,host2:3306)) for automatic failover when a host becomes unavailable. [GH-2312]
api, sdk: Add additional constants for commonly used headers. [GH-2323]
api: Add ClientCertBytes and ClientKeyBytes as possible in-memory cert contents in TLSConfig. [GH-2798]
api: Add first-class support for /sys/namespaces APIs via .Sys().CreateNamespace(...) & co. [GH-2955]
api: Add methods to list and scan keys to the KVv1 and KVv2 client. [GH-3220]
api: Allow disabling automatic configuration from environment variables in the API client via a DisableEnvironment field on Config and a NewConfig constructor to create clean client configurations. [GH-2834]
sdk/helper/consts: Add AllowedJWTSignatureAlgorithmsEAB. [GH-2464]
ui: Add lang="en" attribute to html tag. [GH-2580]
ui: Update EmberJS to v4.12 LTS. [GH-2653]

CHANGES

command: Remove buffering and delayed release of logs during startup phase of server, agent, proxy & debug subcommands. This includes the removal of the undocumented and hidden -disable-gated-logs flag. [GH-2620]
command: operator generate-root now uses the authenticated /sys/generate-root-token endpoints instead of the deprecated /sys/generate-root endpoints. [GH-3190]
core: net/http.ServeMux in Go 1.26 now uses a 307 redirect instead of a 301 redirect when given a bare path which doesn't exist in the multiplexer but which a path with a trailing slash exists for. This causes some POST/PUT operations to fail with a 400 instead of 404, as OpenBao does not allow writes to paths ending in a slash. See also: https://go.dev/doc/go1.26. [GH-3072]
core/identity: Remove corrupt namespace identity groups created prior to v2.5.0 during unseal; affected groups must be recreated by an administrator. Check for deleting corrupt group in server startup logs. [GH-2454]
sys/init, sys/rekey/init: The stored_shares parameter was removed and will now be ignored. [GH-2662]
sys/seal-status: Renamed misleading build_date response field to commit_date. [GH-2678]
sys/version-history: Renamed misleading build_date response field to commit_date. [GH-2678]
api: Removed the StoredShares field from InitRequest and RotateInitRequest structs. [GH-2662]
api: (*Sys).GenerateRoot* methods now use the authenticated /sys/generate-root-token endpoints instead of the deprecated /sys/generate-root endpoints. [GH-3190]
packaging: Renamed misleading ldflags definition BuildDate to CommitDate. Build systems need to adjust their pipelines to reflect this change. [GH-2678]
packaging/container: Removed name, maintainer, vendor, version, release, revision, summary, and description labels from container images in favor of the already attached OpenContainers labels. If you have tooling that relies on these labels, instruct it to use the OpenContainers labels instead. [GH-2589]
packaging/container: The openbao & openbao-hsm container images now run under the openbao user rather than the root user by default, matching the default behavior of openbao-ubi variants:
- Note that the container entrypoint will always drop down to the openbao user before starting OpenBao even if started as root. The additional capabilities are only used pre-startup to automatically fix up permissions of files accessed by OpenBao. [GH-2589]
- If you rely on the container initially running as root by default, you can revert to this behavior by manually specifying the user in your container engine.
packaging/ui: Switch from yarn to pnpm. [GH-2791]
releases: Artifacts on GitHub now follow consistent naming across archives, SBOMs and signatures. Most notably, "x86_64" or "amd64" is now always "amd64", and the operating system is always lowercased. [GH-3209]
releases: Checksums are now provided as a single, consolidated checksums.txt artifact as opposed to per-OS checksum files such as checksums-linux.txt. [GH-3209]

BUG FIXES

command: Fix bao operator rotate-keys and bao operator rekey warning about new key shares when rotating the barrier root key only. [GH-2648]
command/agent: Fix in-memory sink panic when proxying auth/token/lookup-self while unauthenticated. [GH-3462]
command/server: Revoke the transient root token after declarative self-initialization, including failure paths. [GH-3346]
core: Propagate keyring upgrades of sealable namespaces to read-enabled standby nodes. [GH-3409]
core/seal: Fix /sys/rotate/root/update returning a random, unused key share value when rotating the barrier root key using recovery keys. [GH-2648]
core/listeners: Close HTTP servers first before closing the underlying listener. [GH-2703]
core/namespaces: Fix PATCH on a namespace returning status 500 on missing or nonexistent namespace. [GH-2955]
core/audit: Ensure config-driven audit mounts are removed from storage when removed from configuration. [GH-3488]
core/audit: Include request.id for path-help audit entries [GH-3440]
core/auth: Ensure inline auth does not generate in-memory lease information. [GH-3343]
core/mfa: Handle invalidation for login MFA within namespaces, ensuring standby nodes respond appropriately on writes. [GH-3283]
core/workflows: Ensure logical.Request.Connection is set to allow certificate auth and login MFA to work. [GH-3465]
seal/pkcs11: Fix "invalid key format" error when key_id is provided but key_label is not. [GH-3231]
seal/pkcs11: Properly strip hex prefix when setting key_id as hex value. [GH-3231]
physical/raft: Forward bootstrap challenge/answer requests to active node, fixing raft join failures via load balancer. [GH-2976]
sys/plugin: Fix plugin reload returning success for non-existent plugin. [GH-2398]
sys/quotas: Fix unintentional attempts to delete quotas on standby nodes when mount is removed. [GH-3316]
sys/raw: Prevent writes to and return distinctive error reading storage associated with sealed namespaces. [GH-3426]
secrets/pki: Add missing migration for not_after_bound and not_before_bound role fields. [GH-3031]
secrets/pki: /sign-verbatim now preserves the original subject encoding from the CSR. Previously, UTF8String values were re-encoded as PrintableString when the subject contained only ASCII characters. [GH-2861]
openapi: Add missing support for reporting SCAN on endpoints. [GH-2902]
openapi: Add missing support for reporting PATCH support on endpoints. [GH-3289

DEPRECATIONS

core/seal: Following the introduction of pluggable Auto Unseal support in this release, the built-in versions of the alicloudkms, awskms, azurekeyvault, gcpckms, ocikms and pkcs11 Auto Unseal mechanisms will be removed in v2.7.0 and remain available as external plugins only. [GH-2586]
physical/file: Deprecate file storage backend for removal in v2.7.0. [GH-2849]
packaging, seal/pkcs11: Following the introduction of pluginized HSM/PKCS#11 Auto Unseal support in this release, the HSM distribution of OpenBao will be discontinued by v2.7.0. PKCS#11 support remains available via the PKCS#11 plugin which can be used together with the standard distribution of OpenBao. [GH-2586]
packaging: Drop builds for 32-bit ARM Windows as part of its removal from Go 1.26. [GH-3191]
packaging/container: Architecture-specific container image tags such as openbao/openbao:2.6.0-arm64 will not be published starting with this release. Refer to multi-arch container images instead (simply openbao/openbao:2.6.0). [GH-3209]
auth/kerberos: The built-in Kerberos auth plugin has been deprecated and slated for removal from the main OpenBao binary distribution in v2.7.0. It will be included in openbao-plugins going forward. [GH-3371]
auth/ldap: The built-in LDAP auth plugin has been deprecated and slated for removal from the main OpenBao binary distribution in v2.7.0. It will be included in openbao-plugins going forward. [GH-3371]
auth/radius: The built-in RADIUS auth plugin has been deprecated and slated for removal from the main OpenBao binary distribution in v2.7.0. It will be included in openbao-plugins going forward. [GH-3371]
secret/ldap: The built-in LDAP secrets plugin has been deprecated and slated for removal from the main OpenBao binary distribution in v2.7.0. It will be included in openbao-plugins going forward. [GH-3371]

New Contributors

@MatthieuCoder made their first contribution in feat: add decode_pac option into the kerberos credentials plugin #2211
@kaelres made their first contribution in fix(profiles): changed the checked object in nested eval_* blocks used to find mismatch between map and direct types #2239
@Tosta-Mista made their first contribution in feat(ecosystem): Add helvethink to vendors #2279
@thgoebel made their first contribution in Add Securosys to the integrators page #2298
@radoslawszulgo made their first contribution in Add Percona as an integrator to OpenBao ecosystem #2327
@boumba100 made their first contribution in Added Crypto4A as an integration member to the ecosystem section on the Openbao website #2333
@andsens made their first contribution in Fix error logging during auth when there are no trustedChains #2355
@gianklug made their first contribution in feat: add loading and error indicator to downloads page #2365
@mijenne made their first contribution in Website: Fix typo in bao cli examples #2370
@ioboi made their first contribution in Add bespinian to vendors #2369
@oneswig made their first contribution in Add StackHPC as an OpenBao integrator #2376
@ecksun made their first contribution in Find SSH keys with ssh subcommand #2419
@AndrewCharlesHay made their first contribution in feat: add cyclop linter for cyclomatic complexity checks #2423
@kangetsu121 made their first contribution in chore: replace Vault with OpenBao in CLI help text #2526
@stormshield-gt made their first contribution in Fix title hierarchy in x509 rotation doc #2490
@operatorequals made their first contribution in feat: add GatePlane as an integration member #2542
@dbanetto made their first contribution in Allow initalize blocks in dev mode #2463
@tongpu made their first contribution in fix: add missing lang attribute to UI #2580
@JAYKRISHNAN made their first contribution in docs(docs): Add missing documentation on HTTP audit device #2628
@stephnangue made their first contribution in Add Warden as an integration member #2621
@XiaoPengMei made their first contribution in website: document inheritable rate-limit quotas #2723
@EnricoFusi made their first contribution in Add password_hash parameter to userpass engine #2702
@axilleas made their first contribution in Fix PostgreSQL storage metric names in telemetry docs #2788
@cropalato made their first contribution in database/mysql: Add multi-host connection failover support #2312
@ldesauw made their first contribution in doc(integrators): add OVHcloud as integrator in OpenBao ecosystem #2807
@jon4hz made their first contribution in agent: allow changing the uid and gid of a file sink #2851
@janlauber made their first contribution in docs: add natron as vendor #2889
@gregory-ruch-duokey made their first contribution in Add DuoKey as an integrator #2906
@nneul made their first contribution in Add support for BAO_TOKEN_PATH to override ~/.vault-token #2706
@nireo made their first contribution in Replace os.MkdirTemp to t.TempDir in tests #3024
@esticansat made their first contribution in Add unit testing for certutil helpers #2981
@alexa-gt made their first contribution in Reload vault stanza TLS config on SIGHUP #3038
@eklatzer made their first contribution in fix: Fix request handling filtering for the no data case #3063
@rndmh3ro made their first contribution in fix: incorrect helm install command in docs #3066
@bfabio made their first contribution in ci: add workflow to validate publiccode.yml #3065
@mpldr made their first contribution in fix: nil-guard d.autopilot before calling GetState #3054
@james-knippes made their first contribution in Add Nitrokey NetHSM PKCS#11 seal configuration guide #3004
@szamuboy made their first contribution in website: add Origoss Solutions as vendor #3104
@theartusz made their first contribution in Docs: Document bound_service_account_namespace_selector usage. #3217
@avesst made their first contribution in fix(website): typo in yum.repos.d path #3274
@abuango made their first contribution in Adds Kubermatic to the Vendors page #3294
@TheJayMann made their first contribution in Add Host header to logical.Request headers #3325
@mrclki made their first contribution in Add T Cloud Public KMS seal doc #3376
@nicbaz made their first contribution in fix(sink): in-memory token retrieval panics if unset #3462
@Flamefire made their first contribution in audit: Fix missing request ID in audit log for help operations #3440

What's Changed

Add changelog entry for LDAP, Kerberos, and RADIUS by @cipherboy in Add changelog entry for LDAP, Kerberos, and RADIUS #3371
Add T Cloud Public KMS seal doc (Add T Cloud Public KMS seal doc #3376 by @mrclki) backported by @phil9909 in Add T Cloud Public KMS seal doc (#3376) #3392
Fix source tarball release (Fix source tarball release #3356 by @satoqz) backported by @phil9909 in Fix source tarball release (#3356) #3393
Add patch support to OpenAPI schema (Add patch support to OpenAPI schema #3289 by @cipherboy) backported by @phil9909 in Add patch support to OpenAPI schema (#3289) #3394
fix(command): revoke self-init root token (fix(command): revoke self-init root token #3346 by @dc-tec) backported by @phil9909 in fix(command): revoke self-init root token (#3346) #3395
Bump github.com/hashicorp/go-discover from 1.2.0 to 1.3.0 (Bump github.com/hashicorp/go-discover from 1.2.0 to 1.3.0 #3364 by @dependabot) backported by @phil9909 in Bump github.com/hashicorp/go-discover from 1.2.0 to 1.3.0 (#3364) #3397
Update mount, auth, and namespace limits (Update mount, auth, and namespace limits #3424 by @cipherboy) backported by @phil9909 in Update mount, auth, and namespace limits (#3424) #3444
Adjust sys/raw endpoint interaction with implicitly sealed namespaces (Adjust sys/raw endpoint interaction with implicitly sealed namespaces #3426 by @wslabosz-reply) backported by @phil9909 in Adjust sys/raw endpoint interaction with implicitly sealed namespaces (#3426) #3467
fix(sink): in-memory token retrieval panics if unset (fix(sink): in-memory token retrieval panics if unset #3462 by @nicbaz) backported by @phil9909 in fix(sink): in-memory token retrieval panics if unset (#3462) #3468
Fix missing request ID in audit log for help operations (audit: Fix missing request ID in audit log for help operations #3440 by @Flamefire) backported by @phil9909 in Fix missing request ID in audit log for help operations (#3440) #3469
Fix LIST ACL deny bypass caused by wildcards (Fix LIST ACL deny bypass caused by wildcards #3389 by @cipherboy) backported by @satoqz in Fix LIST ACL deny bypass caused by wildcards (#3389) #3474
Fix ACL templates allow wildcard chars in substitution (Fix ACL templates allow wildcard chars in substitution #3401 by @phil9909) backported by @satoqz in Fix ACL templates allow wildcard chars in substitution (#3401) #3473
Switch to constant-time comparison recovery token (Switch to constant-time comparison recovery token #3388 by @cipherboy) backported by @satoqz in Switch to constant-time comparison recovery token (#3388) #3472
Support Login MFA in profile engine (Support Login MFA in profile engine #3465 by @cipherboy) backported by @satoqz in Support Login MFA in profile engine (#3465) #3471
Fix link to PKI CEL page by @cipherboy in Fix link to PKI CEL page #3476
Bump Go to 1.26.5 (Bump Go to 1.26.5 #3479 by @satoqz) by @satoqz in Bump Go to 1.26.5 (#3479) #3480
Add documentation on CEL for JWT (Add documentation on CEL for JWT #3423 by @cipherboy) backported by @phil9909 in Add documentation on CEL for JWT (#3423) #3484
Add v2.6.0 to docs website (Add v2.6.0 to docs website #3475 by @cipherboy) backported by @satoqz in Add v2.6.0 to docs website (#3475) #3485
Pin ubi10-minimal to b217fa6 (Bump ubi10-minimal from 5bc43c1 to b217fa6 #3412 by @dependabot) backported by @phil9909 in Pin ubi10-minimal to b217fa6 (#3412) #3445
Propagate keyring updates of all namespaces to standby nodes (Propagate keyring updates of all namespaces to standby nodes #3409 by @wslabosz-reply) backported by @cipherboy in Propagate keyring updates of all namespaces to standby nodes (#3409) #3491
Fix removal of config-based audit device (Fix removal of config-based audit device #3488 by @satoqz) backported by @cipherboy in Fix removal of config-based audit device (#3488) #3492
Rename substitutions -> identity templates (Rename substitutions -> identity templates #3470 by @cipherboy) backported by @cipherboy in Rename substitutions -> identity templates (#3470) #3493
Ensure templates do not render secrets to stdout (Ensure templates do not render secrets to stdout #3494 by @cipherboy) backported by @cipherboy in Ensure templates do not render secrets to stdout (#3494) #3495
Add changelog for v2.6.0 GA by @satoqz in Add changelog for v2.6.0 GA #3496

Full Changelog: v2.5.5...v2.6.0

This discussion was created from the release v2.6.0.

Blacks-Army · 2026-07-14T22:55:32Z

Blacks-Army
Jul 14, 2026

Hi,

I’m trying to set allow_wildcards_in_identity_templates=true for the policy sys/policy/forgejo, but the value is not persisted.

The write succeeds, but reading the policy still shows:

allow_wildcards_in_identity_templates: false

It looks like the field is being ignored during update. Could you please check if this is expected behavior or a bug?

Server and client are on the same version.

1 reply

cipherboy Jul 15, 2026
Maintainer Author

Replied and copied to an issue: #3502

Navigation Menu

OpenBao

v2.6.0 #3498

Uh oh!

{{title}}

Uh oh!

What's Changed

Replies: 1 comment 1 reply

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

OpenBao

v2.6.0 #3498

Uh oh!

cipherboy Jul 14, 2026 Maintainer

FEATURES

SECURITY

IMPROVEMENTS

CHANGES

BUG FIXES

DEPRECATIONS

New Contributors

What's Changed

Replies: 1 comment · 1 reply

Uh oh!

Blacks-Army Jul 14, 2026

Uh oh!

cipherboy Jul 15, 2026 Maintainer Author

cipherboy
Jul 14, 2026
Maintainer

Replies: 1 comment 1 reply

Blacks-Army
Jul 14, 2026

cipherboy Jul 15, 2026
Maintainer Author