# OpenBao v2.6.1 - Product: OpenBao (https://whatsnew.fyi/product/openbao) - Vendor: Linux Foundation - Date: 2026-07-22 - Version: v2.6.1 - Original notes: https://github.com/openbao/openbao/releases/tag/v2.6.1 - Permalink: https://whatsnew.fyi/product/openbao/releases/v2.6.1 What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. --- - **changed** — Revert removal of legacy, non-opencontainers image labels for maximum compatibility - **changed** — Introduce PATCH operation support for modifying the values of specific parameters in core/policies - **fixed** — Ensure leases are not inadvertently cached on standby nodes - **fixed** — Allow removal of expiration from policies on POST/PUT to sys/policies/acl/ by eliding the parameter; use PATCH to update policies without modifying unnecessary parameters - **fixed** — Fix limit=0 and negative limits bypassing the pagination_limit ACL option - **fixed** — Fix persistence of new allow_wildcards_in_identity_templates and allow_slashes_in_identity_templates parameters in storage - **fixed** — Ensure initial salt is created without transaction in auth/approle to avoid deadlocks - **fixed** — Fix patch operation of CEL roles losing existing data (bound_audiences, not_before_leeway, clock_skew_leeway, and expiration_leeway) in auth/jwt - **fixed** — Ensure salt cache is invalidated properly on standby nodes in auth/token - **fixed** — Ensure all log messages are visible under plugin.ServeMultiplex(...) by default to align with plugin.Serve(...) - **fixed** — Better support non-usr-merged distributions in containerized testing - **fixed** — Ensure that labels on UBI-based images comply with Red Hat's certification requirements ##### CHANGES * packaging/container: Revert removal of legacy, non-opencontainers image labels for maximum compatibility. [[GH-3504](https://github.com/openbao/openbao/pull/3504)] ##### IMPROVEMENTS * core: Warn on `sys/` key with no explicit invalidation handler; please report if you see a log line with `no mechanism to invalidate cache`. [[GH-3555](https://github.com/openbao/openbao/pull/3555)] * core/policies: Introduce PATCH operation support for modifying the values of specific parameters. [[GH-3506](https://github.com/openbao/openbao/pull/3506)] ##### BUG FIXES * core/expiration: Ensure leases are not inadvertently cached on standby nodes. [[GH-3555](https://github.com/openbao/openbao/pull/3555)] * core/policies: Allow removal of `expiration` from policies on POST/PUT to `sys/policies/acl/` by eliding the parameter; use PATCH to update policies without modifying unnecessary parameters. [[GH-3506](https://github.com/openbao/openbao/pull/3506)] * core/policies: Fix `limit=0` and negative limits bypassing the `pagination_limit` ACL option. [[GH-3518](https://github.com/openbao/openbao/pull/3518)] * core/policies: Fix persistence of new `allow_wildcards_in_identity_templates`, `allow_slashes_in_identity_templates` parameters in storage. [[GH-3506](https://github.com/openbao/openbao/pull/3506)] * auth/approle: Ensure initial salt is created without transaction to avoid deadlocks. [[GH-3556](https://github.com/openbao/openbao/pull/3556)] * auth/jwt: Fix patch operation of CEL roles losing existing data (`bound_audiences` `not_before_leeway`, `clock_skew_leeway` and `expiration_leeway`). [[GH-3551](https://github.com/openbao/openbao/pull/3551)] * auth/token: Ensure salt cache is invalidated properly on standby nodes. [[GH-3555](https://github.com/openbao/openbao/pull/3555)] * sdk/plugin: Ensure all log messages are visible under `plugin.ServeMultiplex(...)` by default to align with `plugin.Serve(...)`. [[GH-3536](https://github.com/openbao/openbao/pull/3536)] * sdk: Better support non-usr-merged distributions in containerized testing. [[GH-3554](https://github.com/openbao/openbao/pull/3554)] * packaging/container: Ensure that labels on UBI-based images comply with Red Hat's certification requirements. [[GH-3504](https://github.com/openbao/openbao/pull/3504)]
##### What's Changed * Set user=root when invoking OpenBao for Alpine (#3499 by @cipherboy) backported by @cipherboy in https://github.com/openbao/openbao/pull/3501 * Add OVHcloud KMS seal documentation (#3503 by @Sakutaroo) backported by @satoqz in https://github.com/openbao/openbao/pull/3524 * Restore container image labels & fix UBI-specific ones (#3504 by @pree) backported by @satoqz in https://github.com/openbao/openbao/pull/3525 * Fix policy persistence issue, introduce PATCH support for policies (#3506 by @cipherboy) backported by @phil9909 in https://github.com/openbao/openbao/pull/3538 * Allow all log messages in multiplexed plugins (#3536 by @cipherboy) backported by @phil9909 in https://github.com/openbao/openbao/pull/3537 * Fix limit=0 and negative limits bypassing pagination_limit ACL cap (#3518 by @RealFakeAccount) backported by @phil9909 in https://github.com/openbao/openbao/pull/3548 * Fix profile source headings, response field (#3550 by @cipherboy) backported by @phil9909 in https://github.com/openbao/openbao/pull/3553 * auth/jwt: fix patch operation of CEL roles lost data (#3551 by @phil9909) backported by @phil9909 in https://github.com/openbao/openbao/pull/3552 * Fix lease renewal cache invalidation (#3555 by @cipherboy) backported by @phil9909 in https://github.com/openbao/openbao/pull/3566 * Ensure AppRole salt is created without transaction (#3556 by @cipherboy) backported by @phil9909 in https://github.com/openbao/openbao/pull/3565 * Copy binary to additional path in test container (#3554 by @cipherboy) backported by @cipherboy in https://github.com/openbao/openbao/ _[Truncated at 4000 characters — full notes: https://github.com/openbao/openbao/releases/tag/v2.6.1]_