Downloads require an access key. Sign in with your access key to enable them.
Adfinis
Log in

Products / OpenBao / v2.7.2

OpenBao

OpenBao v2.7.2

Stable release v2.7.2 — binaries, Arch packages, an RPM repository, a DEB repository, and container images. Verification data: checksums, GPG signatures, Sigstore provenance, and SBOMs.

Release notes

SECURITY

  • auth/cert: Add resolve path canonicalization to CRL paths. GHSA-736f-82w7-hj22. [GH-4323]
  • secrets/approle: Add resolve path canonicalization in Role ID paths. GHSA-736f-82w7-hj22. [GH-4323]
  • secrets/identity: Ensure client_type=public is denied with client_credentials=true in the OIDC provider. GHSA-q824-44ff-f5j5. [GH-4323]
  • secrets/ssh: Deny wildcards (*) in SSH certificate identity templating by default. Configurable via the allow_wildcards_in_identity_templates parameter. GHSA-h76r-48x5-36hg. [GH-4323]
  • secrets/transit: Ensure imported key backup does not allow clobbering arbitrary keys through path traversal. GHSA-5pmx-2p74-x478. [GH-4323]

IMPROVEMENTS

  • ui: Add fields to configure external keys in PKI. [GH-4306]

BUG FIXES

  • core: Fix rate limit exempt paths being unresponsive during post-unseal. [GH-4293]
  • core: Fix sudo-capable tokens failing sudo checks on their final use. [GH-4158]
  • core/plugins: Fix transactions started by external plugins failing when using the PostgreSQL storage backend. [GH-4177]
  • core/plugins: Ensure plugin backend reloading with scope=global actually performs a cluster-wide reload. [GH-4221]
  • core/plugins: Avoid immediate plugin reloads on standbys after tuning a mount's version and wait for a direct node-local or scope=global reload instead. [GH-4221]
  • core/namespaces: Fix namespace deletion failing after upgrading to v2.7.x from an earlier version. [GH-4201]
  • auth/oidc: Fix login in direct callback mode by including the namespace in the redirect URI. [GH-4199]
  • secrets/pki: Fix intermediate CSR generation for type kms not using the provided external key and generating an internally-stored private key instead. [GH-4309]
  • kms/transit: Respect the version parameter when exporting a public key instead of fetching the latest version's one. [GH-4297]
  • ui: Fix blank "key bits" dropdown when generating an ML-DSA key in PKI. [GH-4305]

What's Changed

  • Do not attempt singleton mount backend reloads (#4201 by @wslabosz-reply) backported by @phil9909 in https://github.com/openbao/openbao/pull/4247
  • Fix gRPC transaction context (#4177 by @satoqz) backported by @phil9909 in https://github.com/openbao/openbao/pull/4248
  • Fix: include missing namespace in OIDC direct callback (#4199 by @plnryv-reply) backported by @satoqz in https://github.com/openbao/openbao/pull/4274
  • Fix sudo-enforced request handling with single-use tokens (#4158 by @wslabosz-reply) backported by @satoqz in https://github.com/openbao/openbao/pull/4276
  • Improve backend reloading across a cluster (#4221 by @satoqz) backported by @satoqz in https://github.com/openbao/openbao/pull/4275
  • Backport dependencies, bump Go on v2.7.x by @satoqz in https://github.com/openbao/openbao/pull/4313
  • Update favicon mime type to image/svg+xml (#4303 by @ranneetcodes2020-create) backported by @satoqz in https://github.com/openbao/openbao/pull/4310
  • Bump container base images (#4312 by @satoqz) backported by @satoqz in https://github.com/openbao/openbao/pull/4316
  • Do not block sys/health while a standby becomes active (#4293 by @JAYKRISHNAN) backported by @satoqz in https://github.com/openbao/openbao/pull/4298
  • Update PKI UI for external keys (#4306 by @satoqz) backported by @satoqz in https://github.com/openbao/openbao/pull/4318
  • Fix ML-DSA key bits dropdown (#4305 by @satoqz) backported by @satoqz in https://github.com/openbao/openbao/pull/4319
  • Fix PKI intermediate + external keys (#4309 by @satoqz) backported by @satoqz in https://github.com/openbao/openbao/pull/4315
  • Bump github.com/openbao/go-kms-wrapping/kms/transit/v2 from 2.1.0 to 2.1.1 (#4297 by @satoqz) backported by @satoqz in https://github.com/openbao/openbao/pull/4321
  • Address security issues for v2.7.2 - release/2.7.x branch (#4323 by @cipherboy) backported by @cipherboy in https://github.com/openbao/openbao/pull/4324
  • Add release notes for v2.7.2 by @satoqz in https://github.com/openbao/openbao/pull/4326

Full Changelog: https://github.com/openbao/openbao/compare/v2.7.1...v2.7.2

Binaries

Precompiled archives from the official GitHub release.

Packages

Install from mirrored RPM/DEB repositories (package signatures and signed repo metadata verified at sync), or download Arch packages from the release.

RPM

Add the mirrored RPM repository. YUM/DNF substitutes $basearch for the host architecture.

Credentials are stored in /etc/yum.repos.d/openbao.repo (mode 0600). Your username is filled in when signed in; enter your access key at the hidden prompt (input is not echoed). After your administrator rotates a key, re-run these commands or update the credential file(s). Delete /etc/yum.repos.d/openbao.repo to remove the repository configuration.

read -rs ACCESS_KEY
sudo install -m 0600 /dev/null /etc/yum.repos.d/openbao.repo
sudo tee /etc/yum.repos.d/openbao.repo > /dev/null <<EOF
[openbao]
name=openbao
baseurl=https://releases.robertdebock.nl/pulp/content/openbao/rpm/\$basearch/
username=<CLIENT_NAME>
password=${ACCESS_KEY}
enabled=1
# Package signatures: verified with the upstream key (gpgcheck).
# Repository metadata: signed by the Adfinis mirror (repo_gpgcheck).
# List both keys under gpgkey so DNF can import them for packages and metadata.
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://openbao.org/assets/openbao-gpg-pub-20240618.asc https://releases.adfinis.com/keys/adfinis-repo-metadata.asc
EOF
unset ACCESS_KEY
sudo dnf install openbao

Browse RPM repositoriesSign in to download

Containers

Authenticate before pulling. Paste your access key at the hidden prompt when running the commands below.

Docker stores credentials in ~/.docker/config.json after login. Your username is filled in when signed in; enter your access key at the hidden prompt (input is not echoed). After your administrator rotates a key, re-run these commands or update the credential file(s). Run docker logout releases.robertdebock.nl to remove registry credentials from ~/.docker/config.json.

read -rs ACCESS_KEY
echo "$ACCESS_KEY" | docker login releases.robertdebock.nl -u <CLIENT_NAME> --password-stdin
unset ACCESS_KEY
docker pull releases.robertdebock.nl/openbao/openbao:2.7.2

Verification

SHA256 checksums
54 files verified, 137 not covered by upstream checksums.
Checksum manifest authenticity
Signature verified against the pinned upstream key.
GPG signatures
Detached signatures mirrored alongside the artifacts.
Sigstore provenance
Sigstore bundles mirrored alongside the artifacts.
SBOM
SPDX documents mirrored for this release.

Checksum coverage is required for: arch_pkg, binary. A release with an unverified file in one of those classes is not published.

Checksums
GPG signatures
Cosign / Sigstore
SBOM

Release source

Upstream source
https://github.com/openbao/openbao/releases/tag/v2.7.2
Published upstream
2026-10-26
Last successful sync
— when this mirror last downloaded and verified the bundle

Browse release tree

All files for v2.7.2Sign in to download All versions