Downloads require an access key. Sign in with your access key to enable them.
Adfinis
Log in

Products / OpenBao / v2.7.0

OpenBao

OpenBao v2.7.0

Stable release v2.7.0 — binaries, Arch packages, an RPM repository, a DEB repository, and container images. Verification data: checksums, GPG signatures, Sigstore provenance, and SBOMs.

Release notes

SECURITY

  • agent, proxy: Ensure the quit endpoint correctly requires the X-Vault-Request header when specified by listener configuration. GHSA-8gmq-wv9h-fcwp. [GH-4065]
  • auth/cert, auth/kubernetes, auth/userpass, secrets/pki, core/policies, core/workflows: Use ResolvePathOperation to define canonical URLs for canonicalized resources. GHSA-fg5x-7whg-6c28. [GH-4065]
  • core/plugins: Ensure plugin command name is relative to plugin_directory prior to executing. GHSA-j6wc-jpvg-xfxq. [GH-4065]
  • core/plugins: Ensure writes to sys/plugins/catalog/* endpoints are restricted to the root namespace. GHSA-cg72-x35g-xfp8. [GH-4065]
  • core/policies: Ensure denied ACL policy template evaluation returns an error and is not silently dropped. GHSA-hr5j-3j78-4vh2. [GH-4065]
  • core/policies: Prevent cross-namespace policy resolution traversal in the LRU policy cache, allowing unintentional cross-namespace access. GHSA-mjch-vcw3-hhmf. [GH-4065]
  • sdk: Prevent TypeKVPair, TypeHeader from leaking malformed request data into audit logs in plaintext. GHSA-8xxq-mq9m-xmhw. [GH-4065]
  • secrets/pki: Forbid issuance of non-validated SANs through ACME. GHSA-x8fg-h69x-p28f. [GH-4065]
  • ui: Remove support for prompt=none redirection in the OIDC provider. GHSA-2cjw-94fw-wqjx. [GH-4065]

FEATURES

  • External Keys: The PKI and Transit secret engines can now use KMS plugins to perform cryptographic operations without storing key material in OpenBao. [GH-3956]

- Configure mappings to HSM or KMS-backed keys via the /sys/external-keys APIs and grant access to select mounts.

- Use the PKI engine to sign certificates &co with external private keys.

- Use the Transit engine to sign, verify, encrypt, and decrypt payloads with external key material.

- Several KMS plugins provide support:

- Support for PKCS#11-backed keys is included via the kms-pkcs11 plugin available in openbao-plugins.

- Support for Transit-backed keys is built-in. This is similar in concept to the built-in Transit seal.

- Like Auto Seal support via KMS plugins, the interface is provider-agnostic: Develop plugins and enable support for additional providers at any time.

  • ML-DSA Support in PKI: Introduces support for the ML-DSA (NIST's FIPS 204) signature algorithm for all CA, CSR, and leaf actions. [GH-3903]

- ML-DSA is a widely standardized post-quantum cryptography (PQC) algorithm resistant to attacks from quantum computers.

- Note that Go's OCSP implementation does not support ML-DSA so will be unusable with ML-DSA typed issuers.

  • ML-DSA Support in Transit: Introduces support for the ML-DSA (NIST's FIPS 204) signature algorithm. [GH-3909]

- Generate, import, and export keys of type mldsa-44, mldsa-65 and mldsa-87.

- Create and verify pure ML-DSA signatures.

  • Enable Pure-PQC TLS: TLS connections can now use pure post-quantum key exchanges and certificates. [GH-3769]

- Operators can specify tls_key_exchange_preferences in server, agent, and proxy listeners to enforce PQC key exchange algorithms (SecP256r1MLKEM768, SecP384r1MLKEM1024, X25519MLKEM768, and MLKEM1024).

- Operators can use ML-DSA certificates via these listeners as well.

- Outbound TLS connections from OpenBao can now connect to servers with the above key exchange algorithms or presenting a ML-DSA server or CA certificate.

  • PostgreSQL Horizontal Scalability: Enable read scalability on the PostgreSQL storage backend similar to existing Raft support. [GH-3904]

- Requires ha_enabled = true to be set and cluster_addr to be reachable (establishing a forwarding RPC connection) from standby nodes to the primary.

- In the event of extended leadership loss, standby nodes will come up as read-enabled.

- Only works with PostgreSQL physical replication; will not work with logical replication.

  • Strong Consistency Control: Support X-Vault-Index and X-Vault-Inconsistent headers to ensure client/server consistency. [GH-3839]

- X-Vault-Index is now sent when a write is performed.

- The X-Vault-Inconsistent request header can take the following values to control the fallback behavior when the node is out of date:

- fail, to respond with 429 Too Many Requests and a Retry-After value,

- forward-active-node to forward the request to the active node, or

- await-state to hold the request locally to attempt to catch up, optionally falling back to one of the above behaviors (if also specified) or the server default.

- On listeners, three new configuration parameters are now respected:

- consistency_fallback_behavior to set the default fallback for await-state,

- consistency_missing_header_forward to automatically forward requests which do not have any consistency control headers, and

- consistency_max_index_wait to indicate the maximum amount of time await-state should pause before forwarding the request.

  • PebbleDB Storage Backend: This storage backend is a non-HA, durable backend using PebbleDB for transactions and improved performance. [GH-3879]
  • Control Groups: Add support for a new ACL policy stanza, control_group, which specifies when a second party must approve a request for a path. [GH-3436]

IMPROVEMENTS

  • command/server: Add tls_auto_reload configuration option to automatically reload TLS certificate and key files when their contents change, without requiring SIGHUP. [GH-3530]
  • command/server: Include disable_standby_reads, allow_unauthenticated_workflows, and unsafe_relative_paths in sanitized config output. [GH-3433]
  • command/status: Add support for -field argument to bao status. [GH-3750]
  • command/token: Add support for -field argument to bao token lookup. [GH-3618]
  • command/namespace/seal-status: Add support for -field and -format argument to bao namespace seal-status. [GH-3750]
  • core: Add support for revoke-self with wrapping tokens. [GH-3688]
  • core: Switch to cipher.NewGCMWithRandomNonce for fewer nonce generation calls. [GH-3290]
  • core/seal: Add configuration options to disable Auto Seal health checks and customize health check intervals and timeout. [GH-3653]
  • core/metrics: Report vault.core.unsealed=0 when OpenBao is sealed via dedicated metrics loop. [GH-3430]
  • core/server: Support storage-indicated index values in Server Side Consistent Tokens (SSCTs), improving their utility. Previously these tokens always had an index value of 0. [GH-3839]
  • core/plugins: Allow auth & secret mounts to automatically request the latest installed version of the underlying external plugin via plugin_version=latest. [GH-3914]
  • core/plugins: Allow pinning OCI-based plugins by manifest digest (e.g., ghcr.io/openbao/openbao-plugin-secrets-aws@sha256:<digest>) instead of providing the sha256sum of the inner plugin binary. [GH-3915]
  • core/plugins: Automatically determine binary_name for OCI plugins based on the image's ENTRYPOINT or CMD if unset in configuration. [GH-3760]
  • core/plugins: Reload KMS plugin configuration stanzas on SIGHUP and respawn plugin clients as needed, enabling plugin upgrades at runtime. [GH-3738]
  • storage/raft: Automatically create the storage directory if it does not exist. [GH-3649]
  • sys/raw: Allow reading backed up unseal or recovery shares. [GH-3863]
  • auth/cert: Add an Envoy decoder to x_forwarded_for_client_cert_decoders, enabling the processing of leaf certificates in the Envoy XFCC header. [GH-2863]
  • auth/oidc: Return oidc_discovery_url validation errors (like bad issuer) from the underlying library. [GH-3574]
  • secrets/pki: Support use_pss in issuers/generate/intermediate/:type calls, allowing for CSRs with PSS signatures from RSA-typed intermediates. [GH-3861]
  • secrets/pki: Add optional ACME client port and host configuration to support non-privileged operation when a load balancer forwards challenges from ports 80 and 443. [GH-3034]
  • packaging/container: Remove all VOLUME instructions. [GH-3711]
  • ui/secrets: Add "Show internal engines" button to, by default, hide the cubbyhole secret engine. [GH-3794]
  • ui: Update ember-data to 4.12.8. [GH-3816]
  • command/plugin: Add bao plugin prune command to remove unused OCI plugin downloads from disk. [GH-4000]
  • core/mfa: Handle cache entry invalidation on standby nodes after mfa config deletion on leader node. [GH-4033]
  • sdk/logical: Introduce ResolvePathOperation to report canonical URLs prior to ACL evaluation. [GH-4065]

CHANGES

  • agent, proxy: The .../quit and .../cache-clear endpoints now require the X-Vault-Request request header when require_request_header = true is specified. [GH-4065]
  • command/server: Remove file storage backend support. [GH-3879]
  • core/seal: The pkcs11, alicloudkms, awskms, azurekeyvault, gcpckms and ocikms seals are no longer built-in and must be installed as external plugins, as announced with the v2.6.0 release. [GH-3337]
  • core/plugins: Declarative plugin registration (plugin stanza) no longer requires setting a sha256sum for manually installed plugin binaries. [GH-3759]
  • core/plugins: Default the plugin_auto_register server configuration option to true. [GH-3910]
  • auth/kerberos: The built-in Kerberos auth engine has been removed from the main OpenBao binary distribution. It will be included in openbao-plugins going forward. [GH-3882]
  • auth/ldap: The built-in LDAP auth engine has been removed from the main OpenBao binary distribution. It will be included in openbao-plugins going forward. [GH-3882]
  • auth/radius: The built-in RADIUS auth engine has been removed from the main OpenBao binary distribution. It will be included in openbao-plugins going forward. [GH-3882]
  • secrets/ldap: The built-in LDAP secret engine has been removed from the main OpenBao binary distribution. It will be included in openbao-plugins going forward. [GH-3882]
  • secrets/pki: Due to a breaking change in Go 1.27, OpenBao will no longer accept FQDNs ending with a ., e.g., example.com.. [GH-3752]
  • sdk: Drop the helper/pointerutil package. Its functionality is natively available in Go as of 1.26 via new syntax around the new builtin. [GH-3532]
  • releases: Discontinue the HSM distribution of OpenBao, as announced with the v2.6.0 release. PKCS#11 functionality remains available via the PKCS#11 KMS plugin. [GH-3337]
  • packaging: The Go module was moved to github.com/openbao/openbao/v2 and large portions of the codebase were moved behind an internal/ package. As a result, packagers must update their -ldflags to embed version information at github.com/openbao/openbao/v2/internal/version instead of github.com/openbao/openbao/version. [GH-3210]

BUG FIXES

  • command: Fix -field= flag discarding API warnings (e.g., unrecognized parameters) instead of printing them to stderr. [GH-3672]
  • command/operator: Fix double file close in snapshot restoration. [GH-3939]
  • command/server: Fix config merge condition for plugin_download_max_size. [GH-3437]
  • command/server: Fix boolean config fields being dropped when multiple -config paths are used. [GH-3433]
  • core: The response of sys/leader did not contain is_self when it was supposed to be false. [GH-3932]
  • core/ha: Fix broken cross-version request forwarding during rolling upgrades to v2.6.x from an earlier minor version. [GH-3900]
  • core/plugins: Ensure that a mount's storage view is no longer marked read-only following a successful plugin reload. [GH-3936]
  • core/identity: Fix periodic key rotation and expiration attempts on standby nodes resulting in read-only errors. [GH-3949]
  • core/namespaces: Gracefully skip partially-created namespaces during unseal instead of panicking. [GH-3353]
  • core/listeners: Fix broken TCP listener on OpenBSD. [GH-3951]
  • core/listeners: Set ACME cache path according to tls_acme_cache_path. [GH-3872]
  • core/server: Add missing disable_ssct_token parameter to support enabling SSCTs. [GH-3839]
  • core/recovery: Avoid panic during listing of namespace contents due to uninitialized namespace store. [GH-3925]
  • core/recovery: Fix generation of recovery token via bao operator generate-root by allowing status checks. [GH-3924]
  • storage/raft: Add existence verification of the Raft node before attempting to promote or demote. [GH-3350]
  • storage/raft: Fix performance regression caused by a second transaction during batch application to write the last applied log index. [GH-3844]
  • storage/raft: Prevent the Raft log from growing indefinitely if fewer than snapshot_threshold entries are written before next restart. [GH-3381]
  • storage/postgresql: Set transaction limit to one less than max_parallel, ensuring HA lock renewal and non-transaction operations can always proceed. [GH-3913]
  • secrets/pki: Don't pick a default value for signature_bits based on the key type of the certificate being issued as it applies to the issuer's key, not the certificate's key. [GH-3858]
  • secrets/pki: Fix use_pss=true + signature_bits=0 on a role incorrectly resulting in certificates signed via PKCS#1 v1.5 instead of correctly using PSS. [GH-3858]
  • sys/raw: Allow creating new entries via sys/raw; when doing so without compression, compression_type="none" must be specified. [GH-3933]
  • sys/rotate: Fix existing unseal/recovery share backups going unreadable after upgrading to v2.6.x from an earlier version. [GH-3863]
  • sys/workflows: Fix Check-And-Set in workflow API. [GH-3870]
  • api: Don't read BAO_WRAP_TTL to determine a request's wrap TTL if DisableEnvironment is set. [GH-3527]
  • ui: Fix invalid CSS class causing uncentered text on MFA method create page. [GH-3885]
  • core/auth: Ensure invalidation updates description and reloads on changes to config, options, and plugin versions. [GH-3967]
  • core/identity: Fix group entity memberships being dropped on unseal when unsafe_cross_namespace_identity flag is enabled. [GH-4041]
  • core/mfa: Properly handle MFA enforcement configs deletion from storage. [GH-4033]
  • core/mounts: Ensure invalidation updates description and reloads on changes to config, options, and plugin versions. [GH-3967]

DEPRECATIONS

  • command: The file storage backend is deprecated for bao operator migrate and will be removed in v2.8.0. [GH-3879]

New Contributors

  • @mrclki made their first contribution in https://github.com/openbao/openbao/pull/3376
  • @riton made their first contribution in https://github.com/openbao/openbao/pull/3292
  • @sivapalan made their first contribution in https://github.com/openbao/openbao/pull/3437
  • @nicbaz made their first contribution in https://github.com/openbao/openbao/pull/3462
  • @Flamefire made their first contribution in https://github.com/openbao/openbao/pull/3440
  • @Sakutaroo made their first contribution in https://github.com/openbao/openbao/pull/3503
  • @RealFakeAccount made their first contribution in https://github.com/openbao/openbao/pull/3518
  • @pascallibenzi made their first contribution in https://github.com/openbao/openbao/pull/3574
  • @clement-software made their first contribution in https://github.com/openbao/openbao/pull/3530
  • @redabenmakdad made their first contribution in https://github.com/openbao/openbao/pull/3604
  • @timb-controlplane made their first contribution in https://github.com/openbao/openbao/pull/3622
  • @Cloonson made their first contribution in https://github.com/openbao/openbao/pull/3672
  • @olegdayo made their first contribution in https://github.com/openbao/openbao/pull/3684
  • @smcaine made their first contribution in https://github.com/openbao/openbao/pull/3685
  • @ackammawork made their first contribution in https://github.com/openbao/openbao/pull/3690
  • @chaehni made their first contribution in https://github.com/openbao/openbao/pull/3733
  • @Shoowa made their first contribution in https://github.com/openbao/openbao/pull/3765
  • @datosh made their first contribution in https://github.com/openbao/openbao/pull/3787
  • @trutzonline made their first contribution in https://github.com/openbao/openbao/pull/3710
  • @fean5959a made their first contribution in https://github.com/openbao/openbao/pull/3844
  • @hannanavi made their first contribution in https://github.com/openbao/openbao/pull/3841
  • @tron1point0 made their first contribution in https://github.com/openbao/openbao/pull/3902
  • @DeadlySurgeon made their first contribution in https://github.com/openbao/openbao/pull/4009

What's Changed over Beta

  • Add greater mount entry invalidation (#3967 by @cipherboy) backported by @cipherboy in https://github.com/openbao/openbao/pull/4051
  • Add plugin prune command, OCI downloader test suite (#4000 by @satoqz) backported by @cipherboy in https://github.com/openbao/openbao/pull/4052
  • Support External Mu for MLDSA Signatures (#4009 by @DeadlySurgeon) backported by @cipherboy in https://github.com/openbao/openbao/pull/4053
  • Move github.com/google/cel-go -> cel.dev/cel-go (#4010 by @satoqz) backported by @cipherboy in https://github.com/openbao/openbao/pull/4054
  • Login enforcement delete actually deletes storage entry (#4033 by @wslabosz-reply) backported by @cipherboy in https://github.com/openbao/openbao/pull/4055
  • Add more docs on External Keys (#4044 by @satoqz) backported by @cipherboy in https://github.com/openbao/openbao/pull/4059
  • Fix SecP384r1MLKEM1024 typo in docs (#4045 by @datosh) backported by @cipherboy in https://github.com/openbao/openbao/pull/4058
  • Fix group entity memberships being dropped on unseal when unsafe_cross_namespace_identity flag is enabled (#4041 by @wslabosz-reply) backported by @cipherboy in https://github.com/openbao/openbao/pull/4057
  • Bump alpine, ubi10-minimal images (#4046 by @satoqz) backported by @satoqz in https://github.com/openbao/openbao/pull/4062
  • Security updates for v2.7.0 + v2.6.3 (#4065 by @cipherboy, @Luiggi33 and @satoqz) backported by @cipherboy in https://github.com/openbao/openbao/pull/4067
  • Bump kms/transit (#4064 by @satoqz) backported by @satoqz in https://github.com/openbao/openbao/pull/4072
  • Add changelog for v2.7.0 by @cipherboy in https://github.com/openbao/openbao/pull/4070

Full Changelog: https://github.com/openbao/openbao/compare/v2.7.0-beta20260909...v2.7.0

Binaries

Precompiled archives from the official GitHub release.

Packages

Install from mirrored RPM/DEB repositories (package signatures and signed repo metadata verified at sync), or download Arch packages from the release.

RPM

Add the mirrored RPM repository. YUM/DNF substitutes $basearch for the host architecture.

Credentials are stored in /etc/yum.repos.d/openbao.repo (mode 0600). Your username is filled in when signed in; enter your access key at the hidden prompt (input is not echoed). After your administrator rotates a key, re-run these commands or update the credential file(s). Delete /etc/yum.repos.d/openbao.repo to remove the repository configuration.

read -rs ACCESS_KEY
sudo install -m 0600 /dev/null /etc/yum.repos.d/openbao.repo
sudo tee /etc/yum.repos.d/openbao.repo > /dev/null <<EOF
[openbao]
name=openbao
baseurl=https://releases.robertdebock.nl/pulp/content/openbao/rpm/\$basearch/
username=<CLIENT_NAME>
password=${ACCESS_KEY}
enabled=1
# Package signatures: verified with the upstream key (gpgcheck).
# Repository metadata: signed by the Adfinis mirror (repo_gpgcheck).
# List both keys under gpgkey so DNF can import them for packages and metadata.
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://openbao.org/assets/openbao-gpg-pub-20240618.asc https://releases.adfinis.com/keys/adfinis-repo-metadata.asc
EOF
unset ACCESS_KEY
sudo dnf install openbao

Browse RPM repositoriesSign in to download

Containers

Authenticate before pulling. Paste your access key at the hidden prompt when running the commands below.

Docker stores credentials in ~/.docker/config.json after login. Your username is filled in when signed in; enter your access key at the hidden prompt (input is not echoed). After your administrator rotates a key, re-run these commands or update the credential file(s). Run docker logout releases.robertdebock.nl to remove registry credentials from ~/.docker/config.json.

read -rs ACCESS_KEY
echo "$ACCESS_KEY" | docker login releases.robertdebock.nl -u <CLIENT_NAME> --password-stdin
unset ACCESS_KEY
docker pull releases.robertdebock.nl/openbao/openbao:2.7.0

Verification

SHA256 checksums
54 files verified, 137 not covered by upstream checksums.
Checksum manifest authenticity
Signature verified against the pinned upstream key.
GPG signatures
Detached signatures mirrored alongside the artifacts.
Sigstore provenance
Sigstore bundles mirrored alongside the artifacts.
SBOM
SPDX documents mirrored for this release.

Checksum coverage is required for: arch_pkg, binary. A release with an unverified file in one of those classes is not published.

Checksums
GPG signatures
Cosign / Sigstore
SBOM

Release source

Upstream source
https://github.com/openbao/openbao/releases/tag/v2.7.0
Published upstream
2026-09-23
Last successful sync
— when this mirror last downloaded and verified the bundle

Browse release tree

All files for v2.7.0Sign in to download All versions