v2.0.1
2026-05-20T08:52:09Z•43c518094b00d0589c1a3ce98d59609bba3107fa95919c56654f80872069b418
auth-awsauthentication-bypassbreaking-changecloudflare-circldependency-upgradeedwards25519go-josehashicorp-vaultopentelemetryrelease-2.0.0sdk-backportsecurity-fix
What happened
HashiCorp Vault v2.0.0 (published 2026-04-15) includes multiple security fixes and dependency upgrades: cloudflare/circl upgraded to address CVE-2026-1229; filippo.io/edwards25519 upgraded for GO-2026-4503; OpenTelemetry SDK updated to resolve CVE-2026-39883; github.com/go-jose/go-jose updated to address CVE-2026-34986. The release also fixes an auth/aws caching bug that could allow bypassing authentication. There is a breaking change migrating Docker helpers to github.com/moby/moby. Users should prioritize upgrading to 2.0.0 (or the relevant backported SDK tags) to remediate the listed CVEs,,
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- hashicorp_vault_releases
- Record identifier
- 43c518094b00d0589c1a3ce98d59609bba3107fa95919c56654f80872069b418
- Enrichment time
- 2026-05-20T08:52:09Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.