HashiCorp Vault

Vault now removes cap_ipc_lock at build time and no longer supports mlock() in containers, requires PostgreSQL backends to use Azure Workload Identity instead of Managed Identity, and patches multiple ACL/deny-policy bypasses caused by case-variant or trailing-slash resource names. Operators must set disable_mlock = true and disable swapping in container deployments, add IPC_LOCK capability at the runtime level, and migrate PostgreSQL authentication configs from Managed Identity to Workload Identity before upgrading.

Matters for: Teams running Vault in containerized environments with PostgreSQL storage backends on Azure, and operators relying on ACL deny policies for multi-tenant access control.

This release fixes several security vulnerabilities by updating apache/thrift, golang.org/x/crypto, and google.golang.org/grpc, and caps concurrent raft retry-join workers at 20 to prevent overload, erroring with 'too many concurrent raft retry joins in progress' beyond that limit. It also adds an Okta provider with group fetching for JWT auth, an RFC 5280 revocation reason field for PKI revoke endpoints, and fixes bugs in token lookup status codes, mount path placement, secrets-sync associations listing, and PKI unified CRL rebuilding.

Matters for: Relevant for operators running multi-node Vault clusters with Raft storage and teams using PKI secrets engines or secrets-sync in Vault Enterprise.

Vault now supports PKCS#12 and JKS certificate bundle output for PKI endpoints, automatic DNS-01 challenge fulfillment with Route53, Azure DNS, Google Cloud DNS, and RFC2136 servers, SLH-DSA hybrid sign/verify in the Transit engine, and a new Agent Registry UI section for viewing and managing registered AI agents and their policies. Because issuer_id and unique_id_claim can no longer be mutated after an OAuth Resource Server profile is created, operators who need to change either field must delete and recreate the affected profile.

Matters for: This matters for platform teams issuing certificates for Java or Windows applications that require PKCS#12 or JKS keystores, and for enterprises using Vault's OAuth Resource Server feature to authenticate AI agents.