Vault v2.1.0 released on 01-09-2026
Vault v2.1.0 is out now. It delivers security fixes and dependency updates alongside several enterprise features — notably an Agent Registry UI, PKI DNS-01 automation for multiple providers, PKCS#12/JKS bundle support and PQC hybrid signing in Transit.
See the project’s GitHub release notes or the official Vault pages for full details and upgrade guidance.
What’s in this release
- Security fixes: upgrades to go.etcd.io/etcd/client/pkg/v3 → v3.7.1 (fixes GO-2026-6107) and software.sslmate.com/src/go-pkcs12 → v0.7.2 (fixes GO-2026-5052).
- Enterprise features: Agent Registry UI to view and manage registered AI agents, entities/aliases, policies and status; automatic DNS-01 challenge fulfilment for PKI External CA with AWS Route53, Azure DNS, Google Cloud DNS and RFC2136 (BIND).
- PKI and crypto: PKCS#12 (PFX) and JKS bundle support on relevant PKI endpoints (base64, password-protected), and SLH-DSA PQC support for hybrid sign/verify in the Transit engine (enterprise), compatible with ECDSA and Ed25519.
Upgrade notes
- OAuth Resource Server profiles: issuer_id and unique_id_claim are immutable after profile creation — operators must delete and recreate profiles to change these fields.
- Enterprise plugin and dependency updates: update secrets/openldap to v0.18.4+ent and ensure the upgraded etcd and go-pkcs12 dependencies are compatible with your environment when upgrading or rolling back.
Share your experience with v2.1.0 — problems, fixes, or unexpected behaviour — so others can learn from any gotchas during upgrade and operation.
