openbao

FEATURES

• Namespace Sealing: Allow Shamir seal configuration on namespace creation. [GH-3297]
  • Partitions tenant storage with distinct cryptographic key material.
  • Allows tenants to revoke access to their namespace via seal operation without impacting other tenants.
  • Uses global synchronization of namespace seal status, allowing easier management from multi-node deployments.
• Auto Unseal plugins: Add a new kms plugin type that enables Auto Unseal mechanisms to be distributed as external binary plugins. [GH-2586]
  • Declaratively register KMS plugins via plugin "kms" "name" { } stanzas in the server configuration, making "name" available as an Auto Unseal mechanism via seal "name" { }.
  • KMS plugins automatically restart and recover from crashes, avoiding a full instance restart when a seal reaches a bad state (e.g., via a misbehaving PKCS#11 library).
  • Pre-built plugins for many of the seals currently built into OpenBao are available at https://github.com/openbao/openbao-plugins. A plugin-based seal takes priority over a built-in seal if a matching plugin is installed. Note that several provider-specific built-in seals will be removed from OpenBao in v2.7.0 and remain available as external plugins only. Also see the deprecations section of these release notes.
  • Develop custom Auto Unseal mechanisms tailored to your use case using the SDK.
• Workflows: This adds new endpoints under sys/workflows to allow operators to create workflows and users to execute them.
  • Workflows allow the creation of simplified or managed interfaces over OpenBao's standard API.
  • Use of the allow_unauthenticated_workflows server configuration value enables unauthenticated execution of workflows; any dispatched requests still require authentication but this can be provided as a request parameter.
  • Workflows are built on the common profile engine powering declarative self-initialization and use the same syntax. [GH-2728]
• Authenticated root generation: New /sys/generate-root-token endpoints are available as replacements for the deprecated unauthenticated ones. [GH-3041]
• Distroless container images: This is a new container image variant based on distroless/static, available as openbao-distroless. The only executable contained in these images is OpenBao itself. [GH-2592]

SECURITY

• command/agent: Ensure previously rendered secrets do not appear in stdout on failures. GHSA-444v-8vxr-p36h. [GH-3494]
• core/recovery: Use constant-time token comparison in recovery mode. GHSA-34fc-gh42-pj53. [GH-3388]
• core/policies: Prevent LIST operations bypassing capabilities = ["deny"] from a more specific wildcard ACL grant. GHSA-xp3c-3jw3-4vcr. [GH-3389]
• core/policies: If the value of a template expression contains a + or * character, it will now be rejected by default. Set allow_wildcards_in_identity_templates = true to overwrite. GHSA-59w7-v8rr-pr4p. [GH-3401]
• core/policies: If the value of a template expression contains a / character, it will now be rejected by default. Set allow_slashes_in_identity_templates = true to overwrite. GHSA-59w7-v8rr-pr4p. [GH-3401]
• secret/pki: If the value of a template expression in allowed_uri_sans_template and allowed_domains contains a * character, it will now be rejected by default. Set allow_globs_in_identity_templates = true to overwrite. GHSA-59w7-v8rr-pr4p. [GH-3401]
• secret/ssh: If the value of a template expression in allowed_users or allowed_domains contains a , character, it will now be rejected by default. Set allow_commas_in_identity_templates = true to overwrite. GHSA-59w7-v8rr-pr4p. [GH-3401]

IMPROVEMENTS

• command: Allow overriding the location of ~/.vault-token via the BAO_TOKEN_PATH environment variable. [GH-2706]
• command/server: Error when unknown keys are present in the declarative self-initialization configuration. [GH-2883]
• command/server: Add CEL support to self-initialization, allowing finer control over structuring requests. [GH-2671]
• command/server: Add text/template support to self-initialization, allowing templating of values from other requests/responses. [GH-2727]
• command/server: Allow conditional execution of self-initialization requests with when keyword. [GH-2739]
• command/server: Allow self-initialization stanzas in development server mode. [GH-2463]
• command/server: Allow setting headers on declarative self-initialization requests. [GH-2737]
• command/agent: Add uid and gid configuration options for the file sink. [GH-2851]
• command/agent: SIGHUP now reloads the client TLS configuration. [GH-3038]
• command/login: Support Kubernetes service account token authentication via -method=kubernetes with both interactive and non-interactive modes. [GH-1891]
• http: Always include full JSON parse and complexity errors in the response instead of hiding it behind a constant error message. [GH-3240]
• http: Ensure that passthrough_request_headers can pass the Host header to plugins. [GH-3325]
• core: The sys/ backend is now a singleton shared across all namespaces, reducing idle memory usage of the OpenBao instance. [GH-3007]
• core/leases: Lease lookup responses will now include path, namespace_path and revoke_error. [GH-1906]
• core/listeners: Add a parameter to allow cross-origin requests to include credentials (Access-Control-Allow-Credentials header). [GH-2262]
• core/profiles: Canonicalize headers before evaluating request. [GH-3465]
• core/profiles: Parse login MFA from request header information. [GH-3465]
• seal/azurekeyvault: Support explicitly setting Azure authentication methods and add support for authenticating using Azure managed identities. [GH-2519]
• seal/pkcs11: When using public/private key encryption, fall back to finding the public key via the private key's CKA_ID if both key halves did not share the same CKA_LABEL. [GH-3231]
• physical/raft: Detect, log, and rollback transactions that have never been committed or rolled-back. If you see the message "transaction was leaked" in your logs, please open an issue. [GH-2185]
• physical/raft: Improve snapshot duration while slightly increasing snapshot size. [GH-3061]
• physical/raft: Support auto_join via DNS SRV records. [GH-3397]
• auth/cert: Add support for X-Tls-Client-Cert, to allow processing of a leaf certificate forwarded from a TLS-terminating reverse proxy. [GH-2080]
• auth/jwt: Add new Kubernetes JWT provider that authenticates to the Kubernetes API using a pod's service account token. [GH-2114]
• auth/kerberos: Add the decode_pac option in order to improve compatibility with Kerberos systems. [GH-2211]
• auth/userpass: Add password_hash field to allow providing a pre-hashed bcrypt password instead of plaintext. [GH-2702]
• secrets/pki: Add encode_json and decode_json CEL helpers. [GH-1549]
• secrets/totp: Add generated, expire_time, and period fields to code generation response. [GH-2585]
• secrets/ssh: Search for public and private key files if -public-key-path and -private-key-path flags aren't given, respectively. [GH-2419]
• database/mysql: Add multi-host connection failover support. Connection URLs can now specify multiple hosts (e.g., tcp(host1:3306,host2:3306)) for automatic failover when a host becomes unavailable. [GH-2312]
• api, sdk: Add additional constants for commonly used headers. [GH-2323]
• api: Add ClientCertBytes and ClientKeyBytes as possible in-memory cert contents in TLSConfig. [GH-2798]
• api: Add first-class support for /sys/namespaces APIs via .Sys().CreateNamespace(...) & co. [GH-2955]
• api: Add methods to list and scan keys to the KVv1 and KVv2 client. [GH-3220]
• api: Allow disabling automatic configuration from environment variables in the API client via a DisableEnvironment field on Config and a NewConfig constructor to create clean client configurations. [GH-2834]
• sdk/helper/consts: Add AllowedJWTSignatureAlgorithmsEAB. [GH-2464]
• ui: Add lang="en" attribute to html tag. [GH-2580]
• ui: Update EmberJS to v4.12 LTS. [GH-2653]

CHANGES

• command: Remove buffering and delayed release of logs during startup phase of server, agent, proxy & debug subcommands. This includes the removal of the undocumented and hidden -disable-gated-logs flag. [GH-2620]
• command: operator generate-root now uses the authenticated /sys/generate-root-token endpoints instead of the deprecated /sys/generate-root endpoints. [GH-3190]
• core: net/http.ServeMux in Go 1.26 now uses a 307 redirect instead of a 301 redirect when given a bare path which doesn't exist in the multiplexer but which a path with a trailing slash exists for. This causes some POST/PUT operations to fail with a 400 instead of 404, as OpenBao does not allow writes to paths ending in a slash. See also: https://go.dev/doc/go1.26. [GH-3072]
• core/identity: Remove corrupt namespace identity groups created prior to v2.5.0 during unseal; affected groups must be recreated by an administrator. Check for deleting corrupt group in server startup logs. [GH-2454]
• sys/init, sys/rekey/init: The stored_shares parameter was removed and will now be ignored. [GH-2662]
• sys/seal-status: Renamed misleading build_date response field to commit_date. [GH-2678]
• sys/version-history: Renamed misleading build_date response field to commit_date. [GH-2678]
• api: Removed the StoredShares field from InitRequest and RotateInitRequest structs. [GH-2662]
• api: (*Sys).GenerateRoot* methods now use the authenticated /sys/generate-root-token endpoints instead of the deprecated /sys/generate-root endpoints. [GH-3190]
• packaging: Renamed misleading ldflags definition BuildDate to CommitDate. Build systems need to adjust their pipelines to reflect this change. [GH-2678]
• packaging/container: Removed name, maintainer, vendor, version, release, revision, summary, and description labels from container images in favor of the already attached OpenContainers labels. If you have tooling that relies on these labels, instruct it to use the OpenContainers labels instead. [GH-2589]
• packaging/container: The openbao & openbao-hsm container images now run under the openbao user rather than the root user by default, matching the default behavior of openbao-ubi variants:
  • Note that the container entrypoint will always drop down to the openbao user before starting OpenBao even if started as root. The additional capabilities are only used pre-startup to automatically fix up permissions of files accessed by OpenBao. [GH-2589]
  • If you rely on the container initially running as root by default, you can revert to this behavior by manually specifying the user in your container engine.
• packaging/ui: Switch from yarn to pnpm. [GH-2791]
• releases: Artifacts on GitHub now follow consistent naming across archives, SBOMs and signatures. Most notably, "x86_64" or "amd64" is now always "amd64", and the operating system is always lowercased. [GH-3209]
• releases: Checksums are now provided as a single, consolidated checksums.txt artifact as opposed to per-OS checksum files such as checksums-linux.txt. [GH-3209]

BUG FIXES

• command: Fix bao operator rotate-keys and bao operator rekey warning about new key shares when rotating the barrier root key only. [GH-2648]
• command/agent: Fix in-memory sink panic when proxying auth/token/lookup-self while unauthenticated. [GH-3462]
• command/server: Revoke the transient root token after declarative self-initialization, including failure paths. [GH-3346]
• core: Propagate keyring upgrades of sealable namespaces to read-enabled standby nodes. [GH-3409]
• core/seal: Fix /sys/rotate/root/update returning a random, unused key share value when rotating the barrier root key using recovery keys. [GH-2648]
• core/listeners: Close HTTP servers first before closing the underlying listener. [GH-2703]
• core/namespaces: Fix PATCH on a namespace returning status 500 on missing or nonexistent namespace. [GH-2955]
• core/audit: Ensure config-driven audit mounts are removed from storage when removed from configuration. [GH-3488]
• core/audit: Include request.id for path-help audit entries [GH-3440]
• core/auth: Ensure inline auth does not generate in-memory lease information. [GH-3343]
• core/mfa: Handle invalidation for login MFA within namespaces, ensuring standby nodes respond appropriately on writes. [GH-3283]
• core/workflows: Ensure logical.Request.Connection is set to allow certificate auth and login MFA to work. [GH-3465]
• seal/pkcs11: Fix "invalid key format" error when key_id is provided but key_label is not. [GH-3231]
• seal/pkcs11: Properly strip hex prefix when setting key_id as hex value. [GH-3231]
• physical/raft: Forward bootstrap challenge/answer requests to active node, fixing raft join failures via load balancer. [GH-2976]
• sys/plugin: Fix plugin reload returning success for non-existent plugin. [GH-2398]
• sys/quotas: Fix unintentional attempts to delete quotas on standby nodes when mount is removed. [GH-3316]
• sys/raw: Prevent writes to and return distinctive error reading storage associated with sealed namespaces. [GH-3426]
• secrets/pki: Add missing migration for not_after_bound and not_before_bound role fields. [GH-3031]
• secrets/pki: /sign-verbatim now preserves the original subject encoding from the CSR. Previously, UTF8String values were re-encoded as PrintableString when the subject contained only ASCII characters. [GH-2861]
• openapi: Add missing support for reporting SCAN on endpoints. [GH-2902]
• openapi: Add missing support for reporting PATCH support on endpoints. [GH-3289

DEPRECATIONS

• core/seal: Following the introduction of pluggable Auto Unseal support in this release, the built-in versions of the alicloudkms, awskms, azurekeyvault, gcpckms, ocikms and pkcs11 Auto Unseal mechanisms will be removed in v2.7.0 and remain available as external plugins only. [GH-2586]
• physical/file: Deprecate file storage backend for removal in v2.7.0. [GH-2849]
• packaging, seal/pkcs11: Following the introduction of pluginized HSM/PKCS#11 Auto Unseal support in this release, the HSM distribution of OpenBao will be discontinued by v2.7.0. PKCS#11 support remains available via the PKCS#11 plugin which can be used together with the standard distribution of OpenBao. [GH-2586]
• packaging: Drop builds for 32-bit ARM Windows as part of its removal from Go 1.26. [GH-3191]
• packaging/container: Architecture-specific container image tags such as openbao/openbao:2.6.0-arm64 will not be published starting with this release. Refer to multi-arch container images instead (simply openbao/openbao:2.6.0). [GH-3209]
• auth/kerberos: The built-in Kerberos auth plugin has been deprecated and slated for removal from the main OpenBao binary distribution in v2.7.0. It will be included in openbao-plugins going forward. [GH-3371]
• auth/ldap: The built-in LDAP auth plugin has been deprecated and slated for removal from the main OpenBao binary distribution in v2.7.0. It will be included in openbao-plugins going forward. [GH-3371]
• auth/radius: The built-in RADIUS auth plugin has been deprecated and slated for removal from the main OpenBao binary distribution in v2.7.0. It will be included in openbao-plugins going forward. [GH-3371]
• secret/ldap: The built-in LDAP secrets plugin has been deprecated and slated for removal from the main OpenBao binary distribution in v2.7.0. It will be included in openbao-plugins going forward. [GH-3371]

New Contributors

• @MatthieuCoder made their first contribution in https://github.com/openbao/openbao/pull/2211
• @kaelres made their first contribution in https://github.com/openbao/openbao/pull/2239
• @Tosta-Mista made their first contribution in https://github.com/openbao/openbao/pull/2279
• @thgoebel made their first contribution in https://github.com/openbao/openbao/pull/2298
• @radoslawszulgo made their first contribution in https://github.com/openbao/openbao/pull/2327
• @boumba100 made their first contribution in https://github.com/openbao/openbao/pull/2333
• @andsens made their first contribution in https://github.com/openbao/openbao/pull/2355
• @gianklug made their first contribution in https://github.com/openbao/openbao/pull/2365
• @mijenne made their first contribution in https://github.com/openbao/openbao/pull/2370
• @ioboi made their first contribution in https://github.com/openbao/openbao/pull/2369
• @oneswig made their first contribution in https://github.com/openbao/openbao/pull/2376
• @ecksun made their first contribution in https://github.com/openbao/openbao/pull/2419
• @AndrewCharlesHay made their first contribution in https://github.com/openbao/openbao/pull/2423
• @kangetsu121 made their first contribution in https://github.com/openbao/openbao/pull/2526
• @stormshield-gt made their first contribution in https://github.com/openbao/openbao/pull/2490
• @operatorequals made their first contribution in https://github.com/openbao/openbao/pull/2542
• @dbanetto made their first contribution in https://github.com/openbao/openbao/pull/2463
• @tongpu made their first contribution in https://github.com/openbao/openbao/pull/2580
• @JAYKRISHNAN made their first contribution in https://github.com/openbao/openbao/pull/2628
• @stephnangue made their first contribution in https://github.com/openbao/openbao/pull/2621
• @XiaoPengMei made their first contribution in https://github.com/openbao/openbao/pull/2723
• @EnricoFusi made their first contribution in https://github.com/openbao/openbao/pull/2702
• @axilleas made their first contribution in https://github.com/openbao/openbao/pull/2788
• @cropalato made their first contribution in https://github.com/openbao/openbao/pull/2312
• @ldesauw made their first contribution in https://github.com/openbao/openbao/pull/2807
• @jon4hz made their first contribution in https://github.com/openbao/openbao/pull/2851
• @janlauber made their first contribution in https://github.com/openbao/openbao/pull/2889
• @gregory-ruch-duokey made their first contribution in https://github.com/openbao/openbao/pull/2906
• @nneul made their first contribution in https://github.com/openbao/openbao/pull/2706
• @nireo made their first contribution in https://github.com/openbao/openbao/pull/3024
• @esticansat made their first contribution in https://github.com/openbao/openbao/pull/2981
• @alexa-gt made their first contribution in https://github.com/openbao/openbao/pull/3038
• @eklatzer made their first contribution in https://github.com/openbao/openbao/pull/3063
• @rndmh3ro made their first contribution in https://github.com/openbao/openbao/pull/3066
• @bfabio made their first contribution in https://github.com/openbao/openbao/pull/3065
• @mpldr made their first contribution in https://github.com/openbao/openbao/pull/3054
• @james-knippes made their first contribution in https://github.com/openbao/openbao/pull/3004
• @szamuboy made their first contribution in https://github.com/openbao/openbao/pull/3104
• @theartusz made their first contribution in https://github.com/openbao/openbao/pull/3217
• @avesst made their first contribution in https://github.com/openbao/openbao/pull/3274
• @abuango made their first contribution in https://github.com/openbao/openbao/pull/3294
• @TheJayMann made their first contribution in https://github.com/openbao/openbao/pull/3325
• @mrclki made their first contribution in https://github.com/openbao/openbao/pull/3376
• @nicbaz made their first contribution in https://github.com/openbao/openbao/pull/3462
• @Flamefire made their first contribution in https://github.com/openbao/openbao/pull/3440

What's Changed

• Add changelog entry for LDAP, Kerberos, and RADIUS by @cipherboy in https://github.com/openbao/openbao/pull/3371
• Add T Cloud Public KMS seal doc (#3376 by @mrclki) backported by @phil9909 in https://github.com/openbao/openbao/pull/3392
• Fix source tarball release (#3356 by @satoqz) backported by @phil9909 in https://github.com/openbao/openbao/pull/3393
• Add patch support to OpenAPI schema (#3289 by @cipherboy) backported by @phil9909 in https://github.com/openbao/openbao/pull/3394
• fix(command): revoke self-init root token (#3346 by @dc-tec) backported by @phil9909 in https://github.com/openbao/openbao/pull/3395
• Bump github.com/hashicorp/go-discover from 1.2.0 to 1.3.0 (#3364 by @dependabot) backported by @phil9909 in https://github.com/openbao/openbao/pull/3397
• Update mount, auth, and namespace limits (#3424 by @cipherboy) backported by @phil9909 in https://github.com/openbao/openbao/pull/3444
• Adjust sys/raw endpoint interaction with implicitly sealed namespaces (#3426 by @wslabosz-reply) backported by @phil9909 in https://github.com/openbao/openbao/pull/3467
• fix(sink): in-memory token retrieval panics if unset (#3462 by @nicbaz) backported by @phil9909 in https://github.com/openbao/openbao/pull/3468
• Fix missing request ID in audit log for help operations (#3440 by @Flamefire) backported by @phil9909 in https://github.com/openbao/openbao/pull/3469
• Fix LIST ACL deny bypass caused by wildcards (#3389 by @cipherboy) backported by @satoqz in https://github.com/openbao/openbao/pull/3474
• Fix ACL templates allow wildcard chars in substitution (#3401 by @phil9909) backported by @satoqz in https://github.com/openbao/openbao/pull/3473
• Switch to constant-time comparison recovery token (#3388 by @cipherboy) backported by @satoqz in https://github.com/openbao/openbao/pull/3472
• Support Login MFA in profile engine (#3465 by @cipherboy) backported by @satoqz in https://github.com/openbao/openbao/pull/3471
• Fix link to PKI CEL page by @cipherboy in https://github.com/openbao/openbao/pull/3476
• Bump Go to 1.26.5 (#3479 by @satoqz) by @satoqz in https://github.com/openbao/openbao/pull/3480
• Add documentation on CEL for JWT (#3423 by @cipherboy) backported by @phil9909 in https://github.com/openbao/openbao/pull/3484
• Add v2.6.0 to docs website (#3475 by @cipherboy) backported by @satoqz in https://github.com/openbao/openbao/pull/3485
• Pin ubi10-minimal to b217fa6 (#3412 by @dependabot) backported by @phil9909 in https://github.com/openbao/openbao/pull/3445
• Propagate keyring updates of all namespaces to standby nodes (#3409 by @wslabosz-reply) backported by @cipherboy in https://github.com/openbao/openbao/pull/3491
• Fix removal of config-based audit device (#3488 by @satoqz) backported by @cipherboy in https://github.com/openbao/openbao/pull/3492
• Rename substitutions -> identity templates (#3470 by @cipherboy) backported by @cipherboy in https://github.com/openbao/openbao/pull/3493
• Ensure templates do not render secrets to stdout (#3494 by @cipherboy) backported by @cipherboy in https://github.com/openbao/openbao/pull/3495
• Add changelog for v2.6.0 GA by @satoqz in https://github.com/openbao/openbao/pull/3496

Full Changelog: https://github.com/openbao/openbao/compare/v2.5.5...v2.6.0