Vault
Vault change tracker
Summary tables of important changes that may affect your ability to upgrade Vault.
Changes for 1.20.x
Breaking changes
| Introduced | Recommendations | Edition | Change |
|---|---|---|---|
| 1.20.0 | Yes | All | disable_mlock required for integrated storage |
| 1.20.0 | Yes | All | Rekey cancellations use a nonce |
| 1.20.0 | No | All | Auzre authentication requires bound group or service principal ID |
| 1.20.1 | Yes | All | CVE-2025-6000: File audit devices cannot use executable file permissions |
| 1.20.4 | Yes | CE | Go mod tidy command fails on the community edition |
New behavior
| Introduced | Recommendations | Edition | Change |
|---|---|---|---|
| 1.20.0 | Yes | All | Key pair authentication for Snowflake DB secrets engine |
| 1.20.0 | Yes | All | Audience warning for Kubernetes authentication roles |
| 1.20.3 | No | All | JSON Payload Limits |
| 1.20.5 | Yes | All | Rotation manager schedule strings in UTC |
Known issues
| Found | Fixed | Workaround | Edition | Issue |
|---|---|---|---|---|
| 1.20.0 | No | Yes | Enterprise | Duplicate unseal/seal wrap HSM keys |
| 1.20.0 | 1.20.3 | No. | All. | AWS auto join fails on startup |
| 1.20.0 | 1.20.1 | Yes | Enterprise | Secondary cluster reload overwrites development cluster setting |
| 1.20.0 | 1.20.1 | Yes | All | UI login fails for auth mounts with underscores and unauthenticated listing |
| 1.20.0 | 1.20.1 | Yes | All | GUI navigation error for KV v2 secret paths containing underscores |
| 1.18.4 | No | Yes | All | Failing credential refresh for Snowflake DB secrets engine key pair authentication |
| 1.20.0 | 1.20.1 | Yes | All | Duplicate LDAP password rotations on standby node check-in |
| 1.20.0 | No | No | All | Writing configuration to local auth mount (ldap, aws, gcp, azure) ignores local flag |
| 1.20.0 | No | Yes | Enterprise | Missed events with multiple event clients |
| 1.20.0 | 1.20.5 | No | Enterprise | Full seal rewraps occur on DR/PR failover with multi-seal enabled |
Changes for 1.19.x
General updates
| Update | Introduced | Recommendations | Edition | Change |
|---|---|---|---|---|
| Support change | 1.19.0 | Upgrade | Enterprise | 1.16.x moves to long term support and 1.19 becomes the current LTS version |
Breaking changes
| Introduced | Recommendations | Edition | Change |
|---|---|---|---|
| 1.19.0 | Yes | All | Security improvement for LDAP user DN search with upndomain |
| 1.19.6 | Yes | All | Rekey cancellations use a nonce |
| 1.19.7 | Yes | All | CVE-2025-6000: File audit devices cannot use executable file permissions |
New behavior
| Introduced | Recommendations | Edition | Change |
|---|---|---|---|
| 1.19.0 | No | Enterprise | Anonymized cluster data returned with license utilization |
| 1.19.0 | Yes | All | Identity system duplicate cleanup |
| 1.19.0 | No | All | RADIUS authentication is no longer case sensitive |
| 1.19.0 | No | All | Transit support for Ed25519ph and Ed25519ctx signatures |
| 1.19.1 | Yes | All | Strict validation for Azure auth login requests |
| 1.19.9 | No | All | JSON Payload Limits |
| 1.19.11 | Yes | Enterprise | Rotation manager schedule strings in UTC |
Known issues
Changes for 1.18.x
General updates
| Update | Introduced | Recommendations | Edition | Change |
|---|---|---|---|---|
| Beta removed | 1.18.0 | No | All | Request limiter removed |
Breaking changes
| Introduced | Recommendations | Edition | Change |
|---|---|---|---|
| 1.18.11 | Yes | All | Rekey cancellations use a nonce |
| 1.18.12 | Yes | All | CVE-2025-6000: File audit devices cannot use executable file permissions |
New behavior
| Introduced | Recommendations | Edition | Change |
|---|---|---|---|
| 1.18.0 | No | All | Activity log changes |
| 1.18.0 | Yes | All | Docker image no longer contains curl |
| 1.18.2 | Yes | All | Anonymous product usage metrics collection |
| 1.18.7 | No | All | Strict validation for Azure auth login requests |
| 1.18.14 | No | All | JSON Payload Limits |
Known issues
| Found | Fixed | Workaround | Edition | Issue |
|---|---|---|---|---|
| 1.18.0 | No | Yes | Enterprise | Duplicate unseal/seal wrap HSM keys |
| 1.18.0 | 1.18.9 | Yes | All | Unwanted secret rotation for DB and LDAP roles on restart |
| 1.18.0 | 1.18.7 | Upgrade | All | Vault log file missing subsystem logs |
| 1.18.0 | 1.18.5 | Yes | Enterprise | Secrets sync SSRF protection may block private endpoints |
| 1.18.5 | No | No | All | Authorization failure with Azure federated identity credentials |
| 1.18.5 | 1.18.9 | Upgrade | All | Unexpected DB static role rotations on upgrade |
| 1.18.5 | 1.18.9 | Upgrade | All | Unexpected LDAP static role rotations on upgrade |
| 1.18.6 | 1.18.10 | Yes | Enterprise | External Enterprise plugins cannot run on a standby node when it becomes active |
| 1.18.7 | 1.18.10 | Yes | All | Azure authN fails to authenticate Uniform VMSS instances |
| 1.18.0 | No | No | Enterprise | Full seal rewraps occur on DR/PR failover with multi-seal enabled |
Changes for 1.17.x
General updates
| Update | Introduced | Recommendations | Edition | Change |
|---|---|---|---|---|
| Beta deprecated | 1.17.0 | No | All | Request limiter deprecated |
| Opt out feature | 1.17.0 | Yes | All | PKI sign-intermediate now truncates notAfter field to signing issuer |
Breaking changes
| Introduced | Recommendations | Edition | Change |
|---|---|---|---|
| 1.17.18 | Yes | All | Rekey cancellations use a nonce |
New behavior
| Introduced | Recommendations | Edition | Change |
|---|---|---|---|
| 1.17.0 | No | All | Allowed audit headers now have unremovable defaults |
| 1.17.0 | Yes | All | JWT auth login requires bound_audiences parameter on role |
| 1.17.14 | No | All | Strict validation for Azure auth login requests |
| 1.17.3 | Yes | All | Secrets Sync SSRF Protection May Block Private Endpoints |
| 1.17.9 | No | All | Default report months deprecated for sys/internal/counters |
| 1.17.9 | Yes | All | Vault product usage metrics reporting |
Known issues
Changes for 1.16.x
Breaking changes
| Introduced | Recommendations | Edition | Change |
|---|---|---|---|
| 1.16.0 | Yes | All | Docker image no longer contains curl |
| 1.16.21 | Yes | All | Rekey cancellations use a nonce |
| 1.16.23 | Yes | All | CVE-2025-6000: File audit devices cannot use executable file permissions |
New behavior
| Introduced | Recommendations | Edition | Change |
|---|---|---|---|
| 1.16.0 | No | Enterprise | Activity log changes |
| 1.16.0 | No | All | Auto-rolled billing start date |
| 1.16.0 | Yes | All | Default lease count quota enabled when upgrading from Vault versions before 1.9 |
| 1.16.0 | Yes | All | External plugin variables take precedence over system variables |
| 1.16.0 | Yes | All | LDAP auth login changes |
| 1.16.0 | Yes | All | Product usage reporting |
| 1.16.0 | Yes | All | Secrets Sync cannot be activated from chroot namespace |
| 1.16.0 | No | Enterprise | Secrets Sync now requires setting a one-time flag before use |
| 1.16.18 | No | All | Strict validation for Azure auth login requests |
| 1.16.25 | No | All | JSON Payload Limits |