openbao — The Cyber Toolchain

openbao v2.7.2

Mon, 26 Oct 2026 20:24:37 GMT

OpenBao v2.7.2 adds SSH wildcard-identity control via `allow_wildcards_in_identity_templates` and PKI external-key UI fields.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `allow_wildcards_in_identity_templates` parameter to `secrets/ssh` to control whether wildcards (`*`) are permitted in SSH certificate identity templating (denied by default).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds UI fields to configure external keys in PKI. Breaking changes: • Wildcards (`*`) in SSH certificate identity templating are now denied by default in `secrets/ssh`; existing roles relying on wildcard identity templates will be blocked unless `allow_wildcards_in_identity_templates` is explicitly enabled. • `client_type=public` is now denied when `client_credentials=true` in the OIDC provider (`secrets/identity`); configurations combining both settings will be rejected on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/openbao

openbao v2.6.5

Mon, 26 Oct 2026 20:23:12 GMT

Breaking changes: • Wildcards (`*`) in SSH certificate identity templating are now denied by default in `secrets/ssh`; set `allow_wildcards_in_identity_templates=true` on affected roles to restore prior behavior. • `client_type=public` is now rejected when `client_credentials=true` is set in the `secrets/identity` OIDC provider; configurations combining these two settings will fail. • Imported key backups in `secrets/transit` that relied on path traversal to target arbitrary keys will no longer succeed. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/openbao

openbao v2.7.0

Wed, 23 Sep 2026 17:39:54 GMT

OpenBao v2.7.0 adds External KMS key support, ML-DSA post-quantum crypto, PQC TLS, PostgreSQL read scaling, Control Groups, and PebbleDB storage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `tls_key_exchange_preferences` to server, agent, and proxy listener config to enforce pure post-quantum TLS key exchange algorithms (`SecP256r1MLKEM768`, `SecP384r1MLKEM1024`, `X25519MLKEM768`, `MLKEM1024`).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `consistency_fallback_behavior`, `consistency_missing_header_forward`, and `consistency_max_index_wait` listener configuration parameters for strong consistency control. • Supports `X-Vault-Index` and `X-Vault-Inconsistent` request headers (values: `fail`, `forward-active-node`, `await-state`) to enforce client/server read consistency. • Adds `plugin_version=latest` to allow auth and secret mounts to automatically request the latest installed version of an external plugin. • Adds `bao plugin prune` command to remove unused OCI plugin downloads from disk. • Adds `-field` argument to `bao status` and `bao namespace seal-status` (which also gains `-format`). • Adds `-field` argument to `bao token lookup`. • Adds `tls_auto_reload` configuration option to automatically reload TLS certificate and key files on change without requiring `SIGHUP`. • Adds `x_forwarded_for_client_cert_decoders` Envoy decoder in `auth/cert` to process leaf certificates from the Envoy XFCC header. • Supports `use_pss` in `issuers/generate/intermediate/:type` PKI API calls for CSRs with PSS signatures from RSA-typed intermediates. • Adds External Keys support: PKI and Transit engines can now use KMS plugins via `/sys/external-keys` APIs to perform cryptographic operations without storing key material, with built-in Transit-backed key support and `kms-pkcs11` plugin for PKCS#11. • Introduces ML-DSA (`mldsa-44`, `mldsa-65`, `mldsa-87`) key types in the Transit engine for post-quantum signing and verification. • Introduces ML-DSA (NIST FIPS 204) support in the PKI engine for all CA, CSR, and leaf certificate operations. • Adds PostgreSQL horizontal read scalability on the PostgreSQL storage backend, requiring `ha_enabled = true` and a reachable `cluster_addr`. • Adds PebbleDB storage backend as a non-HA, durable backend using PebbleDB for transactions and improved performance. • Adds `control_group` ACL policy stanza requiring second-party approval for requests to a path. • Allows pinning OCI-based plugins by manifest digest (e.g., `ghcr.io/openbao/openbao-plugin-secrets-aws@sha256:`) instead of providing a `sha256sum` of the plugin binary. • Automatically determines `binary_name` for OCI plugins from the image's `ENTRYPOINT` or `CMD` if unset in configuration. • Reloads KMS plugin configuration stanzas on `SIGHUP` and respawns plugin clients as needed, enabling runtime plugin upgrades. • Adds support for `revoke-self` with wrapping tokens. • Allows reading backed-up unseal or recovery shares via `sys/raw`. • Adds 'Show internal engines' button to the UI secrets list to hide the `cubbyhole` engine by default. • Reports `vault.core.unsealed=0` metric via a dedicated metrics loop when OpenBao is sealed. • Adds configuration options to disable Auto Seal health checks and customize health check intervals and timeout. • Adds optional ACME client port and host configuration in PKI to support non-privileged operation behind a load balancer on ports 80 and 443. • Defaults `plugin_auto_register` server configuration option to `true`. Breaking changes: • The `pkcs11`, `alicloudkms`, `awskms`, `azurekeyvault`, `gcpckms`, and `ocikms` seals are no longer built-in and must be installed as external plugins. • The built-in Kerberos auth engine (`auth/kerberos`) has been removed from the main OpenBao binary; it is now in openbao-plugins. • The built-in LDAP auth engine (`auth/ldap`) has been removed from the main OpenBao binary; it is now in openbao-plugins. • The `file` storage backend has been removed from `command/server`. • The `.../quit` and `.../cache-clear` agent/proxy endpoints now require the `X-Vault-Request` header when `require_request_header = true` is set. • `plugin_auto_register` now defaults to `true`, which may cause previously unregistered plugins to be auto-registered on server start. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/openbao

openbao v2.6.3

Wed, 23 Sep 2026 17:06:02 GMT

OpenBao v2.6.3 adds `ResolvePathOperation` to the SDK and exposes three new fields in sanitized server config output.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `disable_standby_reads`, `allow_unauthenticated_workflows`, and `unsafe_relative_paths` fields to the `command/server` sanitized config output.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Introduces `ResolvePathOperation` in `sdk/logical` to report canonical URLs for resources prior to ACL evaluation. Breaking changes: • The `agent`/`proxy` `.../quit` and `.../cache-clear` endpoints now require the `X-Vault-Request` request header when `require_request_header = true` is set in listener configuration — calls omitting the header will be rejected. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/openbao

openbao v2.5.5

Wed, 17 Jun 2026 11:27:10 GMT

OpenBao v2.5.5 adds ability to clear namespace custom_metadata via API patching. • Supports clearing a namespace's `custom_metadata` by providing a patch that sets `custom_metadata` to `null` at the top-level. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/openbao

openbao v2.5.4

Wed, 20 May 2026 16:15:07 GMT

OpenBao v2.5.4 adds PostgreSQL constraint naming for multi-instance sharing and removes legacy lease endpoints • Enables PostgreSQL storage to use named constraints (`table_pkey`, `ha_table_pkey`) and indices (`table_idx`) when reusing the same database partition for multiple OpenBao instances Breaking changes: • Legacy lease endpoints (`sys/revoke`, `sys/renew`, `sys/revoke-prefix`, and `sys/revoke-force`) are removed, stopping cross-namespace lease modification via these paths Full history on Cyber Toolchain: https://cybertoolchain.io/tools/openbao

openbao v2.5.3

Mon, 20 Apr 2026 19:35:06 GMT

OpenBao v2.5.3 hardens auth and core defaults while adding plugin download size limits. • Adds `disable_unauthed_generate_root_endpoints=false` to re-enable unauthenticated root generation endpoints (disabled by default for security). • Adds `unsafe_relative_paths` config option to permit path segments containing `..` when path traversal blocking is required. Breaking changes: • The `sys/generate-root/*` endpoints are now disallowed by default; existing setups relying on unauthenticated root generation must set `disable_unauthed_generate_root_endpoints=false`. • Request path traversal using `.` and `..` segments is forbidden by default; workflows requiring these in paths must explicitly enable `unsafe_relative_paths`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/openbao

openbao v2.4.3

Wed, 22 Oct 2025 20:27:25 GMT

OpenBao v2.4.3 allows BAO_NAMESPACE=root to map to the root namespace and redacts sensitive parameters from audit logs • Adds `BAO_NAMESPACE=root` support: Setting the `X-Vault-Namespace` header or the `BAO_NAMESPACE` environment variable to "root" now maps to the root namespace, eliminating the need for special-case handling of that value. • Introduces redaction of `HTTPRawBody` response parameters in audit logs to prevent sensitive data leakage (CVE-2025-62513). • Adds automatic redaction of `[]byte` type response parameters in audit logs to prevent binary data leaks (CVE-2025-62705). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/openbao

openbao v2.4.1

Thu, 11 Sep 2025 20:32:45 GMT

OpenBao v2.4.1 adds limits for JSON request body complexity via `max_request_json_memory` and `max_request_json_strings`. • Adds `max_request_json_memory` and `max_request_json_strings` config entries to limit the complexity of JSON in HTTP request bodies. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/openbao

openbao v2.4.0

Thu, 28 Aug 2025 20:39:37 GMT

OpenBao v2.4.0 adds inline auth, declarative init, dynamic audit devices and config validation subcommand • `sys/auth/inline` mount type enables passing authentication information inline with main operations. • Declarative Self-Initialization via a new request-driven initialization path on first server start. • `list_scan_response_keys_filter_path` parameter filters LIST and SCAN responses to readable or listable values. • Configuration-based audit devices allow creating and removing audit devices through server configuration updates applied on restart and SIGHUP. • Delay recovery key generation for auto-unseal mechanisms and make rotation authenticated with new endpoints. • Static key unseal mechanism added for auto-unseal in environments with explicit trust chaining. • `bao operator validate-config` subcommand validates configuration file syntax. • `sys/seal-status` endpoint explicitly adds recovery seal type to the barrier seal type response. Breaking changes: • `certutil.ParsePublicKeyPEM` now returns `crypto.PublicKey` instead of `any`, requiring removal of existing type assertions. • Removed packages `sdk/helper/base62`, `sdk/helper/mlock`, `sdk/helper/parseutil`, `sdk/helper/password`, `sdk/helper/strutil`, and `sdk/helper/tlsutil`; use `github.com/openbao/go-secure-stdlib/xxx` or `github.com/hashicorp/go-secure-stdlib/xxx` instead. • Removed `LegacyStringToSliceHookFunc` from `sdk/framework`; use `mapstructure.StringToWeakSliceHookFunc` instead. • Removed `Initialize` method from `ConnectionProducer` interface and `SQLConnectionProducer` struct in `sdk/database/helper/connutil`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/openbao

openbao v2.3.2

Fri, 08 Aug 2025 04:11:06 GMT

OpenBao v2.3.2 introduces configurable audit mount and log prefixing controls via new API flags. • Adds `unsafe_allow_api_audit_creation` setting to control creation of audit mounts via the API • Adds `allow_audit_log_prefixing` setting to control availability of the `prefix` audit mount option Breaking changes: • The audit subsystem no longer allows creation of new devices via the API unless `unsafe_allow_api_audit_creation` is explicitly enabled. • TOTP codes must now be exactly N numeric digits with no leading or trailing whitespace; malformed codes are rejected by the API. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/openbao

openbao v2.3.1

Wed, 25 Jun 2025 19:26:24 GMT

OpenBao v2.3.1 adds KMIP auto-unseal, full namespaces support (CLI/API/UI), CEL for PKI/roles, and unauthenticated rekey disable listener param • `disable_unauthed_rekey_endpoints` (listener config, default: `false`) to disable unauthenticated rekey operations on `sys/rekey/*` and `sys/rekey-recovery-key/*` endpoints. • Adds KMIP Auto-Unseal capability to automatically unseal OpenBao using the KMIP protocol. • Namespace feature with full lifecycle management (create, read, update, delete), isolated secrets engines/auth methods, remounting between namespaces, and locking/unlocking. • `X-Vault-Namespace` header support for routing requests to specific namespaces alongside path-based routing. • `bao namespace` CLI subcommands and `-namespace` flag for programmatic namespace operations. • Namespaces UI Support including a new namespace picker and namespace management pages in the console. • Common Expression Language (CEL) support in PKI for dynamic certificate policies and complex validation. • CEL login roles support in `auth/jwt` for flexible claim validation and arbitrary templating of `logical.Auth` data. • Support for multiple certificate issuers in SSH secret engine mounts to enable safer rotation of SSH CA key material. Breaking changes: • Illumos build support removed from the release due to broken builds. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/openbao

openbao v2.2.0-beta20250213 (Prerelease)

Thu, 13 Feb 2025 21:43:35 GMT

OpenBao v2.2.0-beta20250213 adds ACME TLS provisioning, PKCS#11 auto-unseal, recursive scanning via SCAN verb and scan ACL, Transit key derivation, and restores the WebUI. • ACME TLS Listener Certificate Provisioning: automatically fetch TLS certificates for OpenBao Server's TCP listeners via an ACME-capable CA (RFC 8555), enabling self-hosted certificate signing [[GH-857](https://github.com/openbao/openbao/pull/857)] • PKCS#11 Auto-Unseal: add support for automatic unsealing of OpenBao using a PKCS#11-enabled HSM or KMS [[GH-889](https://github.com/openbao/openbao/pull/889)] • Scanning: introduce recursive listing within plugins with a separate `scan` ACL capability, the `SCAN` HTTP verb (with `GET` fallback via `?scan=true`), corresponding API endpoints, CLI support, and KVv1/KVv2 engine integration [[GH-763](https://github.com/openbao/openbao/pull/763)] • Transit key derivation: add support for deriving new keys from a base key using named algorithms, currently supporting ECDH (base key as ECC private key, peer_public_key as PEM-encoded public key) [[GH-811](https://github.com/openbao/openbao/pull/811)] • WebUI reintroduction: bring back the web-based user interface for OpenBao management and monitoring [[GH-940](https://github.com/openbao/openbao/pull/940)] • Raft non-voter nodes: allow Raft cluster nodes to join as non-voters, enabling expandable quorum structures without voting rights [[GH-741](https://github.com/openbao/openbao/pull/741)] Full history on Cyber Toolchain: https://cybertoolchain.io/tools/openbao

openbao v2.1.0

Fri, 29 Nov 2024 15:37:48 GMT

OpenBao v2.1.0 adds unlimited mount tables, plugin transactional APIs, PKI CSR storage in Transit, and OIDC device/direct flows • Removes mount table limits by splitting auth/secret mounts into separate entries, enabling hundreds of thousands of mounts • Adds `physical.TransactionalBackend` and `logical.TransactionalStorage` types for plugin developers to perform safe storage transactions • Adds PKI CSR and certificate storage alongside key material in the Transit secret engine without requiring an additional K/V mount • Adds `device` value to `callback_mode` role option in auth/oidc for OIDC device flow authentication • Adds `poll_interval` role option in auth/oidc to control polling frequency for device flow responses • Adds `callbackmode=device` CLI option to the oidc login method for initiating device flow logins • Adds `direct` value to `callback_mode` role option in auth/oidc to direct callbacks straight to the server • Adds `callbackmode=direct` CLI option to the oidc login method for server-direct callback mode • Reintroduces physical/postgres storage driver with paginated list support (preview) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/openbao