hashicorp/vault v2.1.1

on GitHub

2.1.1

September 16, 2026

SECURITY:

• core: Update github.com/apache/thrift to v0.24.0 to fix security vulnerability GHSA-8wv5-x4w7-5gww.
• core: Update golang.org/x/crypto to v0.56.0 to fix security vulnerabilities GO-2026-6354 and GO-2026-6355.
• core: Update google.golang.org/grpc to v1.83.2 to fix security vulnerability GHSA-2v4p-qf9q-27wj.

CHANGES:

• auth/jwt: Added Okta provider with group fetching from Admin API when fetch_groups=true and truncation is detected.
• auth/jwt: Update plugin to v0.26.4
• core/raft: Limited concurrent retry-join workers to 20. Any further retry-join attempts while 20 are in progress will result in an error (too many concurrent raft retry joins in progress).
• core: Bump Go version to 1.26.8

IMPROVEMENTS:

• secrets import: Add allowed_ipv4_cidrs to source_aws and source_azure Secrets Import blocks to allow private CIDR exemptions for SSRF-safe connectivity.
• secrets/pki: add an additional field to include an RFC 5280 revocation reason for (/pki/revoke) and (/pki/revoke-with-key).
• ui: Bump dompurify to 3.4.15 to address SECVULN advisories

BUG FIXES:

• Secrets Recovery (enterprise): Fixing Vault panic in cli when running vault recover without a path.
• auth/jwt: Fixed incorrect HTTP status codes returned during agent ceiling policy evaluation.
• auth/token: Fixed a bug where auth/token/lookup and auth/token/lookup-self returned 403 for JWT tokens in a non-root namespace.
• consumption-billing: Fix OIDC identity token billing units being computed incorrectly across periodic flush cycles. The billing scalar now applies per-token duration adjustment, so the reported scalar and the per-mount attribution breakdown are always consistent.
• core/activitylog (enterprise): Fix a panic in CensusReport ACL policy metrics collection by safely handling transient missing policies and nil policy path/permission data while policies are changing.
• core/mounts: Fixed vault secrets move (and vault auth move) incorrectly placing a mount in the root namespace when the destination path has a leading slash.
• oauth-resource-server (enterprise): Fix issue where RAR enforcement was skipped when the token's iss claim had cosmetic differences (e.g. different casing or trailing slash) compared to the issuer stored in the resource server profile.
• plugins: Fix issue with vault plugin reload -mounts command when run in the root namespace
• secrets-sync (enterprise): Fix LIST /v1/sys/sync/associations intermittently returning zero associations/secrets by forwarding the request to the active node instead of allowing it to be served locally by a performance standby or performance secondary.
• secrets/pki (enterprise): Fix panic in CMPv2 sentinel field parsing when cert request messages are empty.
• secrets/pki (enterprise): Fix unified CRL not being rebuilt after the background transfer copies locally-revoked certificates into unified storage.
• ui: Fix agent registry ceiling policies not displaying due to incorrect property name
• ui: Fix total secrets count binding on secrets sync overview page to match the API response key.
• ui: Resolve the flickering on the login page when a trailing slash is added to the namespace in the field.