Acquisition complete HashiCorp officially joins the IBM family. Learn more
Vault
Vault Home

Vault change tracker

Summary tables of important changes that may affect your ability to upgrade Vault.

Changes for 1.20.x

Breaking changes

FoundRecommendationsEditionIssue
1.20.0YesAlldisable_mlock required for integrated storage
1.20.0YesAllRekey cancellations use a nonce

Known issues

FoundFixedWorkaroundEditionIssue
1.20.0NoYesAllDuplicate unseal/seal wrap HSM keys

Changes for 1.19.x

General updates

ChangeFoundFixedRecsEditionIssue
Support change1.19.0N/AN/AAll1.16.x moves to long term support and 1.19 becomes the current LTS version

Breaking changes

FoundRecommendationsEditionIssue
1.19.0YesAllSecurity improvement for LDAP user DN search with upndomain
1.19.6YesAllRekey cancellations use a nonce

New behavior

FoundRecommendationsEditionIssue
1.19.0NoEnterpriseAnonymized cluster data returned with license utilization
1.19.0YesAllIdentity system duplicate cleanup
1.19.0NoAllRADIUS authentication is no longer case sensitive
1.19.0NoAllTransit support for Ed25519ph and Ed25519ctx signatures
1.19.1YesAllStrict validation for Azure auth login requests

Bugs

FoundFixedWorkaroundEditionIssue
1.19.01.19.3YesAllAutomated rotation stops after unseal
1.19.01.19.4YesAllAWS STS configuration can fail with unspecified STS endpoints
1.19.01.19.4YesEnterpriseExternal Enterprise plugins cannot run on a standby node when it becomes active
1.19.01.19.1UpgradeAllVault log file missing subsystem logs
1.19.11.19.4YesAllAzure authN fails to authenticate Uniform VMSS instances

Known issues

FoundFixedWorkaroundEditionIssue
1.19.0NoYesAllDuplicate unseal/seal wrap HSM keys
1.19.01.19.3YesAllLogin/token renewal failures after group changes
1.19.01.19.3UpgradeAllUnexpected DB static role rotations on upgrade
1.19.01.19.3UpgradeAllUnexpected LDAP static role rotations on upgrade
1.19.01.19.3YesAllUnwanted secret rotation for DB and LDAP roles on restart

Changes for 1.18.x

General updates

ChangeFoundFixedRecsEditionIssue
Beta removed1.18.0N/ANoAllRequest limiter removed

Breaking changes

FoundRecommendationsEditionIssue
1.18.11YesAllRekey cancellations use a nonce

New behavior

FoundRecommendationsEditionIssue
1.18.0NoAllActivity log changes
1.18.0YesAllDocker image no longer contains curl
1.18.2YesAllAnonymous product usage metrics collection
1.18.7NoAllStrict validation for Azure auth login requests

Bugs

FoundFixedWorkaroundEditionIssue
1.18.01.18.7UpgradeAllVault log file missing subsystem logs
1.18.61.18.10YesEnterpriseExternal Enterprise plugins cannot run on a standby node when it becomes active
1.18.71.18.10YesAllAzure authN fails to authenticate Uniform VMSS instances

Known issues

FoundFixedWorkaroundEditionIssue
1.18.0NoYesAllDuplicate unseal/seal wrap HSM keys
1.18.01.18.9YesAllUnwanted secret rotation for DB and LDAP roles on restart
1.18.5NoNoAllAuthorization failure with Azure federated identity credentials
1.18.51.18.9UpgradeAllUnexpected DB static role rotations on upgrade
1.18.51.18.9UpgradeAllUnexpected LDAP static role rotations on upgrade

Changes for 1.17.x

General updates

ChangeFoundFixedRecsEditionIssue
Beta deprecated1.17.0N/ANoAllRequest limiter deprecated
Opt out feature1.17.0N/AYesAllPKI sign-intermediate now truncates notAfter field to signing issuer

Breaking changes

FoundRecommendationsEditionIssue
1.17.18YesAllRekey cancellations use a nonce

New behavior

FoundRecommendationsEditionIssue
1.17.0NoAllAllowed audit headers now have unremovable defaults
1.17.0YesAllJWT auth login requires bound_audiences parameter on role
1.17.14NoAllStrict validation for Azure auth login requests
1.17.3YesAllSecrets Sync SSRF Protection May Block Private Endpoints
1.17.9NoAllDefault report months deprecated for sys/internal/counters
1.17.9YesAllVault product usage metrics reporting

Bugs

FoundFixedWorkaroundEditionIssue
1.17.01.17.17YesEnterpriseExternal Enterprise plugins cannot run on a standby node when it becomes active
1.17.01.17.14UpgradeAllVault log file missing subsystem logs
1.17.141.17.17YesAllAzure authN fails to authenticate Uniform VMSS instances

Known issues

FoundFixedWorkaroundEditionIssue
1.17.01.17.4YesAllAWS Auth Role configuration requires an external_id
1.17.01.17.6YesAllCached activation flags for secrets sync on follower nodes are not updated
1.17.01.17.5UpgradeAllClient tokens and token accessors audited in plaintext
1.17.01.17.3UpgradeAllDeleting an entity-aliases does not remove it from the in-memory database on standby nodes
1.17.0NoYesEnterpriseDuplicate identity groups created when concurrent requests sent to the primary and PR secondary cluster
1.17.0NoYesAllDuplicate unseal/seal wrap HSM keys
1.17.01.17.2UpgradeEnterpriseInput data on Transit Generate CMAC Response
1.17.0NoYesEnterpriseManual entity merges sent to a PR secondary cluster are not persisted to storage
1.17.0NoYesAllPKI OCSP GET requests can return HTTP redirect responses
1.17.0NoUpgradeAllUnwanted secret rotation for DB and LDAP roles on restart
1.17.01.17.1UpgradeAllVault Agent and Vault Proxy consume an excessive amount of CPU
1.17.01.17.3UpgradeEnterpriseVault standby nodes not deleting removed entity-aliases from in-memory database
1.17.11.17.2YesAllPotential DoS when using the deny_unauthorized proxy protocol behavior for a TCP listener
1.17.12NoNoAllAuthorization failure with Azure federated identity credentials
1.17.121.17.16UpgradeAllUnexpected DB static role rotations on upgrade
1.17.121.17.16UpgradeAllUnexpected LDAP static role rotations on upgrade

Changes for 1.16.x

Breaking changes

FoundRecommendationsEditionIssue
1.16.0YesAllDocker image no longer contains curl
1.16.21YesAllRekey cancellations use a nonce

New behavior

FoundRecommendationsEditionIssue
1.16.0NoEnterpriseActivity log changes
1.16.0NoAllAuto-rolled billing start date
1.16.0YesAllDefault lease count quota enabled when upgrading from Vault versions before 1.9
1.16.0YesAllExternal plugin variables take precedence over system variables
1.16.0YesAllLDAP auth login changes
1.16.0YesAllProduct usage reporting
1.16.0YesAllSecrets Sync cannot be activated from chroot namespace
1.16.0NoEnterpriseSecrets Sync now requires setting a one-time flag before use
1.16.18NoAllStrict validation for Azure auth login requests

Bugs

FoundFixedWorkaroundEditionIssue
1.16.01.16.18UpgradeAllVault log file missing subsystem logs
1.16.171.16.21YesEnterpriseExternal Enterprise plugins cannot run on a standby node when it becomes active
1.16.181.16.21UpgradeAllAzure authN fails to authenticate Uniform VMSS instances

Known issues

FoundFixedWorkaroundEditionIssue
1.16.01.16.3YesAllAzure secrets engine role creation failing
1.16.01.16.3YesAllCached activation flags for secrets sync on follower nodes are not updated
1.16.0NoYesEnterpriseDuplicate identity groups created when concurrent requests sent to the primary and PR secondary cluster
1.16.0NoYesAllDuplicate unseal/seal wrap HSM keys
1.16.01.16.1UpgradeAllError logging in with LDAP auth method
1.16.01.16.1UpgradeAllError logging in with LDAP auth method when anonymous group search is enabled
1.16.0NoYesAllExisting clusters do not show the current Vault version in UI by default
1.16.0NoYesEnterpriseManual entity merges sent to a PR secondary cluster are not persisted to storage
1.16.01.16.4YesAllNew nodes added by autopilot upgrades provisioned with the wrong version
1.16.01.16.3YesEnterprisePerformance Standbys revert to Standby mode on unseal
1.16.0NoYesAllPKI OCSP GET requests can return HTTP redirect responses
1.16.01.16.6YesEnterprisePotential DoS when using the deny_unauthorized proxy protocol behavior for a TCP listener
1.16.0NoYesAllSending SIGHUP to vault standby node causes panic
1.16.0NoUpgradeAllUnwanted secret rotation for DB and LDAP roles on restart
1.16.11.16.2YesAllError configuring the JWT auth method
1.16.16NoNoAllAuthorization failure with Azure federated identity credentials
1.16.161.16.20UpgradeAllUnexpected DB static role rotations on upgrade
1.16.161.16.20UpgradeAllUnexpected LDAP static role rotations on upgrade
1.16.31.16.6YesAllJWT auth login requires bound audiences on the role
1.16.31.16.7UpgradeEnterpriseVault standby nodes not deleting removed entity-aliases from in-memory database
1.16.71.16.9UpgradeAllClient tokens and token accessors audited in plaintext
Edit this page on GitHub