Vault v2.0.2 released on 05-06-2026
Vault v2.0.2 is out now. It removes the cap_ipc_lock capability from the vault binary at build time so Vault can run in common container runtimes, but Vault in containers can no longer call mlock(), a breaking change for containerised deployments.
Visit the project’s GitHub release page or official HashiCorp release notes for full details and configuration guidance.
What’s in this release
- Containers: cap_ipc_lock removed at build time; Vault in containers can no longer call mlock(), affecting memory-lock behaviour in containerised deployments.
- Secrets/SSH: RSA key size limited to a maximum of 8192 bits to address CVE-2026-39829; RSA keys larger than 8192 bits must be regenerated or rotated.
- Core and plugins: Go toolchain bumped to 1.26.4 and the enterprise Azure secrets plugin updated to v0.26.4+ent; plugin authors and operators should rebuild or redeploy compiled plugins as needed.
Upgrade notes
- Breaking change for containers: set disable_mlock = true in Vault’s configuration and ensure the host or container runtime has swapping disabled to maintain data safety.
- Rebuild/redeploy any third‑party or compiled plugins to match the Go 1.26.4 toolchain and review the Azure plugin v0.26.4+ent release notes before upgrading enterprise deployments.
Share any feedback or experiences with the upgrade — especially notes from containerised deployments or plugin rebuilds.
