OpenBao v2.6.2

SECURITY

• core: Ensure internal operation types cannot be dispatched from inline authentication and workflows, preventing token creation. GHSA-rh46-vc3j-w2w3. [GH-3831]
• secrets/pki: Also enforce allowed_ip_sans_cidr on IP SANs from CSRs. GHSA-g892-p242-8g86. [GH-3833]

BUG FIXES

• command/agent: Fix file sink chown failing unconditionally on Windows. [GH-3733]
• core: Prevent recovered panic in request handler due to uncanceled active context between initialization and standby/active enablement. [GH-3623]
• core: Propagate requests with wrap info to the active node. [GH-3790]
• core/identity: Write OIDC default keys into per-namespace storage. [GH-3662]
• core/namespaces: Fix fatal failures writing default OIDC keys on standby nodes during namespace creation. [GH-3662]
• sys/raw: Propagate delete and write requests to the active node. [GH-3766]
• sys/leases: Propagate renew, revoke and revoke-prefix requests to the active node by default. [GH-3766]
• sys/quotas: Fix broken enable_rate_limit_audit_logging option. [GH-3673]
• sys/workflows: Allow unauthenticated workflow execution without authentication. [GH-3785]
• audit/http: Fix error wrapping in header parsing so the underlying cause is not lost. [GH-3746]
• ui: Fix client-side validation for auth/userpass user creation. [GH-3625]

• redo the client side validation for userpass (#3625 by @Luiggi33) backported by @phil9909 in https://github.com/openbao/openbao/pull/3677
• Improve stdout audit device description (#3620 by @thgoebel) backported by @phil9909 in https://github.com/openbao/openbao/pull/3678
• Add context cancellation to initialization (#3623 by @cipherboy) backported by @phil9909 in https://github.com/openbao/openbao/pull/3679
• Refactor api-docs into docs for better versions (v2.6.x) by @cipherboy in https://github.com/openbao/openbao/pull/3727
• Backport unauthed workflow configuration fixes (#3808 by @cipherboy and #3785 by @Luiggi33) backported by @cipherboy in https://github.com/openbao/openbao/pull/3809
• Fix missing OIDC default keys for namespaces (#3662 by @wslabosz-reply) backported by @cipherboy in https://github.com/openbao/openbao/pull/3802
• Propagate lease and sys/raw writes to leader node (#3766 by @wslabosz-reply) backported by @cipherboy in https://github.com/openbao/openbao/pull/3807
• Only attempt to change file sink ownership in agent when explicitly requested (#3733 by @chaehni) backported by @cipherboy in https://github.com/openbao/openbao/pull/3805
• Fix HMAC verification for non default algorithms (#3668 by @wslabosz-reply) backported by @cipherboy in https://github.com/openbao/openbao/pull/3803
• Fix error wrapping in HTTP audit device header parsing (#3746 by @sivapalan) backported by @cipherboy in https://github.com/openbao/openbao/pull/3806
• Fix enable_rate_limit_audit_logging not working (#3673 by @phil9909) backported by @cipherboy in https://github.com/openbao/openbao/pull/3804
• Bump Go and dependencies on 2.6.x by @satoqz in https://github.com/openbao/openbao/pull/3811
• Fix malformed Packages.gz (#3826 by @satoqz) backported by @satoqz in https://github.com/openbao/openbao/pull/3827
• Propagate all wrapped-requested requests (#3790 by @wslabosz-reply) backported by @cipherboy in https://github.com/openbao/openbao/pull/3828
• Apply IP SANs filtering on CSRs (#3833 by @cipherboy) backported by @cipherboy in https://github.com/openbao/openbao/pull/3834
• Fix internal operation dispatch creating tokens (#3831 by @cipherboy) backported by @cipherboy in https://github.com/openbao/openbao/pull/3832
• Add changelog for v2.6.2 by @satoqz in https://github.com/openbao/openbao/pull/3830

Full Changelog: https://github.com/openbao/openbao/compare/v2.6.1...v2.6.2