# OpenBao v2.6.2 - Product: OpenBao (https://whatsnew.fyi/product/openbao) - Vendor: Linux Foundation - Date: 2026-08-18 - Version: v2.6.2 - Original notes: https://github.com/openbao/openbao/releases/tag/v2.6.2 - Permalink: https://whatsnew.fyi/product/openbao/releases/v2.6.2 What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. --- - **security** — Ensure internal operation types cannot be dispatched from inline authentication and workflows, preventing token creation - **security** — Also enforce allowed_ip_sans_cidr on IP SANs from CSRs - **fixed** — Fix file sink chown failing unconditionally on Windows - **fixed** — Prevent recovered panic in request handler due to uncanceled active context between initialization and standby/active enablement - **fixed** — Propagate requests with wrap info to the active node - **fixed** — Write OIDC default keys into per-namespace storage - **fixed** — Fix fatal failures writing default OIDC keys on standby nodes during namespace creation - **fixed** — Propagate delete and write requests to the active node - **fixed** — Propagate renew, revoke and revoke-prefix requests to the active node by default - **fixed** — Fix broken enable_rate_limit_audit_logging option - **fixed** — Allow unauthenticated workflow execution without authentication - **fixed** — Fix error wrapping in header parsing so the underlying cause is not lost - **fixed** — Fix client-side validation for auth/userpass user creation ##### SECURITY * core: Ensure internal operation types cannot be dispatched from inline authentication and workflows, preventing token creation. GHSA-rh46-vc3j-w2w3. [[GH-3831](https://github.com/openbao/openbao/pull/3831)] * secrets/pki: Also enforce `allowed_ip_sans_cidr` on IP SANs from CSRs. GHSA-g892-p242-8g86. [[GH-3833](https://github.com/openbao/openbao/pull/3833)] ##### BUG FIXES * command/agent: Fix file sink chown failing unconditionally on Windows. [[GH-3733](https://github.com/openbao/openbao/pull/3733)] * core: Prevent recovered panic in request handler due to uncanceled active context between initialization and standby/active enablement. [[GH-3623](https://github.com/openbao/openbao/pull/3623)] * core: Propagate requests with wrap info to the active node. [[GH-3790](https://github.com/openbao/openbao/pull/3790)] * core/identity: Write OIDC default keys into per-namespace storage. [[GH-3662](https://github.com/openbao/openbao/pull/3662)] * core/namespaces: Fix fatal failures writing default OIDC keys on standby nodes during namespace creation. [[GH-3662](https://github.com/openbao/openbao/pull/3662)] * sys/raw: Propagate delete and write requests to the active node. [[GH-3766](https://github.com/openbao/openbao/pull/3766)] * sys/leases: Propagate renew, revoke and revoke-prefix requests to the active node by default. [[GH-3766](https://github.com/openbao/openbao/pull/3766)] * sys/quotas: Fix broken `enable_rate_limit_audit_logging` option. [[GH-3673](https://github.com/openbao/openbao/pull/3673)] * sys/workflows: Allow unauthenticated workflow execution without authentication. [[GH-3785](https://github.com/openbao/openbao/pull/3785)] * audit/http: Fix error wrapping in header parsing so the underlying cause is not lost. [[GH-3746](https://github.com/openbao/openbao/pull/3746)] * ui: Fix client-side validation for auth/userpass user creation. [[GH-3625](https://github.com/openbao/openbao/pull/3625)]

What's Changed

* redo the client side validation for userpass (#3625 by @Luiggi33) backported by @phil9909 in https://github.com/openbao/openbao/pull/3677 * Improve stdout audit device description (#3620 by @thgoebel) backported by @phil9909 in https://github.com/openbao/openbao/pull/3678 * Add context cancellation to initialization (#3623 by @cipherboy) backported by @phil9909 in https://github.com/openbao/openbao/pull/3679 * Refactor api-docs into docs for better versions (v2.6.x) by @cipherboy in https://github.com/openbao/openbao/pull/3727 * Backport unauthed workflow configuration fixes (#3808 by @cipherboy and #3785 by @Luiggi33) backported by @cipherboy in https://github.com/openbao/openbao/pull/3809 * Fix missing OIDC default keys for namespaces (#3662 by @wslabosz-reply) backported by @cipherboy in https://github.com/openbao/openbao/pull/3802 * Propagate lease and sys/raw writes to leader node (#3766 by @wslabosz-reply) backported by @cipherboy in https://github.com/openbao/openbao/pull/3807 * Only attempt to change file sink ownership in agent when explicitly requested (#3733 by @chaehni) backported by @cipherboy in https://github.com/openbao/openbao/pull/3805 * Fix HMAC verification for non default algorithms (#3668 by @wslabosz-reply) backported by @cipherboy in https://github.com/openbao/openbao/pull/3803 * Fix error wrapping in HTTP audit device header parsing (#3746 by @sivapalan) backported by @cipherboy in https://github.com/openbao/openbao/pull/3806 * Fix `enable_rate_limit_audit_logging` not working (#3673 by @phil9909) backported by @cipherboy in https://github.com/openbao/openbao/pull/3804 * Bump Go and dependencies on 2.6.x by @satoqz in https://github.com/openbao/openbao/pull/3811 * Fix malformed Packages.gz ( _[Truncated at 4000 characters — full notes: https://github.com/openbao/openbao/releases/tag/v2.6.2]_