v2.0.3
2026-06-18T08:52:14Z•810366d24f823309c4c86fb2864f0c2f4f698f7647ed04a35ddfe9898efc3354
aclai-agentauth/radiusbreaking-changeconstant-time-comparisoncontainerscvedependenciesenterprisehashicorp-vaultidentitymlockpath-normalizationreleasersa-key-sizesecretssecurity-fixspiffesshtransform
What happened
HashiCorp Vault release series (v2.0.0 through v2.0.3) with multiple security fixes, dependency upgrades, and behavioral/breaking changes. v2.0.3 fixes an ACL LIST bypass (trailing-slash handling), adds a case_insensitive_names toggle for auth/radius, switches recovery-token comparison to constant-time, and fixes template/quoting escaping in enterprise secrets/plugins; it also normalizes and redirects non-canonical paths. Earlier releases (v2.0.0–v2.0.2) include dependency updates that resolve several CVEs (notably CVE-2026-1229, CVE-2026-34986, CVE-2026-39883) and limit RSA SSH key sizes (max
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- hashicorp_vault_releases
- Record identifier
- 810366d24f823309c4c86fb2864f0c2f4f698f7647ed04a35ddfe9898efc3354
- Enrichment time
- 2026-06-18T08:52:14Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.