v2.0.2
2026-06-06T08:52:13Z•617ef7724e279c09c4eaba9094f0ee45aba49c80bfe77039e7cd6023bea011f9
authbreaking-changecontainerscryptographydependency-updatehashicorp-vaultmlockreleasersasecurityupgradevulnerability
What happened
HashiCorp Vault 2.0.x releases (notably v2.0.2, v2.0.1 and v2.0.0) include multiple security fixes, dependency updates and breaking changes. v2.0.2 removes the cap_ipc_lock container capability at build time (Vault in containers can no longer call mlock(); operators should set disable_mlock = true and ensure swapping is disabled) and restricts RSA key sizes to a maximum of 8192 bits to address CVE-2026-39829. Earlier 2.0.0/2.0.1 releases bump Go to 1.26.4 and update several third-party libraries to remediate cryptographic and auth-related vulnerabilities (including CVE-2026-1229, CVE-2026-3988
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- hashicorp_vault_releases
- Record identifier
- 617ef7724e279c09c4eaba9094f0ee45aba49c80bfe77039e7cd6023bea011f9
- Enrichment time
- 2026-06-06T08:52:13Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.