# Vault v2.1.0

- Product: Vault (https://whatsnew.fyi/product/vault)
- Vendor: HashiCorp
- Date: 2026-09-01
- Version: v2.1.0
- Original notes: https://github.com/hashicorp/vault/releases/tag/v2.1.0
- Permalink: https://whatsnew.fyi/product/vault/releases/v2.1.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Update go.etcd.io/etcd/client/pkg/v3 to v3.7.1 to fix security vulnerability GO-2026-6107
- **security** — Update software.sslmate.com/src/go-pkcs12 to v0.7.2 to fix security vulnerability GO-2026-5052
- **changed** — Add Agentic IAM terms to client licensing model and update terms for Vault Platform licensing model
- **changed** — Bump Go version to 1.26.7
- **changed** — Prevent issuer_id from being mutated after OAuth Resource Server profile creation
- **changed** — Prevent unique_id_claim from being mutated after OAuth Resource Server profile creation
- **changed** — The OAuth Resource Server feature no longer requires activation via the sys/activation-flags/oauth-resource-server/activate endpoint
- **changed** — Update OAuth Resource Server config to include custom claim options for the token's unique identifier and actor
- **changed** — Update OpenLDAP plugin to v0.18.4+ent
- **added** — Add Agent Registry UI with a new Agentic Security section to the primary navigation where operators can view, search, and manage registered AI agents, their associated Vault entities and aliases, assigned policies, and operational status
- **added** — Integrate with AWS Route53, Azure DNS, Google Cloud DNS, and BIND and other RFC2136-compliant servers for automatic DNS-01 challenge fulfillment for PKI External CA
- **added** — Add support for PKCS#12 (PFX) and Java keytool (JKS) certificate bundles to relevant PKI endpoints
- **added** — Add support for SLH-DSA as the PQC component for Hybrid sign/verify operations in Transit engine, compatible with both ECDSA and Ed25519
- **changed** — Remove the restriction that disallowed the use of 'deny' in ceiling policies in agent registry
- **changed** — Replace go.uber.org/atomic with sync/atomic (stdlib) for atomic boolean operations in the pkiexternalca package
- **added** — Add global denylist for revoking OAuth JWTs to prevent authorization of specific tokens across all namespaces
- **changed** — Update Oracle Cloud library to enable seal integration with newer regions
- **changed** — Expose the RSA Private Key field in the UI when generating credentials with the snowflake database secrets engine
- **changed** — Update secrets engine delete confirmation modal to require typing 'delete-engine' to confirm, display the engine name, secret count for KV engines, and a list of what will be permanently deleted
- **fixed** — Fix CA chain extraction from Vault PKI API responses where ca_chain field was always empty in templates due to incorrect type handling of array responses

##### 2.1.0
###### September 01, 2026

SECURITY:

* core: Update go.etcd.io/etcd/client/pkg/v3 to v3.7.1 to fix security vulnerability GO-2026-6107.
* core: Update software.sslmate.com/src/go-pkcs12 to v0.7.2 to fix security vulnerability GO-2026-5052.

CHANGES:

* License: Add Agentic IAM terms to client licensing model and update terms for Vault Platform licensing model.
* core: Bump Go version to 1.26.7.
* oauth-resource-server (enterprise): Prevent issuer_id from being mutated after OAuth Resource Server profile creation. Operators must delete and recreate profiles to change the issuer_id.
* oauth-resource-server (enterprise): Prevent unique_id_claim from being mutated after OAuth Resource Server profile creation. Operators must delete and recreate profiles to change the unique_id_claim.
* oauth-resource-server (enterprise): The OAuth Resource Server feature no longer requires activation via the `sys/activation-flags/oauth-resource-server/activate` endpoint.
* oauth-resource-server (enterprise): Update OAuth Resource Server config to include custom claim options for the token's unique identifier and actor.
* secrets/openldap (enterprise): Update plugin to [v0.18.4+ent](https://github.com/hashicorp/vault-plugin-secrets-openldap/releases/tag/v0.18.4+ent)

FEATURES:

* **Agent Registry UI (enterprise)**: Adds a new Agentic Security section to the primary navigation with an Agent Registry page where operators can view, search, and manage registered AI agents, their associated Vault entities and aliases, assigned policies, and operational status.
* **Automatic DNS-01 Challenge Fulfillment for PKI External CA**: Integrate with the following DNS providers for automatic DNS-01 challenge fulfillment: AWS Route53, Azure DNS, Google Cloud DNS, and BIND and other RFC2136-compliant servers.
* **PKI PKCS#12 and JKS Support**: Adds support for PKCS#12 (PFX) and Java keytool (JKS) certificate bundles to relevant PKI endpoints. Bundles are returned as base64-encoded, password-protected files.
* **SLH-DSA support for Hybrid sign/verify in Transit engine (enterprise)**: Add support for SLH-DSA as the PQC component for Hybrid sign/verify operations. This is compatible with both ECDSA (p-256, P-384, P-521) and Ed25519.
* secrets/pki-external-ca (enterprise): Add support for handling dns-01 challenges for Azure, AWS, GCP, and rfc2136 DNS.

IMPROVEMENTS:

* agent-registry (enterprise): Removed the restriction that disallowed the use of 'deny' in ceiling policies, resulting in request errors.
* agent/pkiexternalca: Replace go.uber.org/atomic with sync/atomic (stdlib) for atomic boolean operations in the pkiexternalca package.
* auth/token: Add global denylist for revoking OAuth JWTs to prevent authorization of specific tokens across all namespaces.
* core/seal (enterprise): Update Oracle Cloud library to enable seal integration with newer regions.
* ui: Bump `dompurify` from `3.4.6` to `3.4.13`.
* ui: Bump shell-quote from 1.8.4 to 1.9.0.
* ui: Exposing the RSA Private Key field in the UI when generating credentials with the snowflake database secrets engine. Previously, this field was only shown in the cli.
* ui: Secrets engine delete confirmation modal now requires typing `delete-engine` to confirm, displays the engine name, secret count (KV engines only), and a list of what will be permanently deleted. ConfirmModal has now been updated to include a optional type-to-confirm.

BUG FIXES:

* agent/pki-external-ca: Fix CA chain extraction from Vault PKI API responses where `ca_chain` field was always empty in templates due to incorrect type handling of array responses
* api: Account for the HTTP Age header when calculating a lease's remaining lifetime, so that leases read or renewed through a caching proxy such as Vault Agent are renewed before they expire.
* core (enterprise): Fix a data race and potential panic during seal/unseal
* core (enterprise): Fix panic in `collectOperatorImportMetrics` when `rout

_[Truncated at 4000 characters — full notes: https://github.com/hashicorp/vault/releases/tag/v2.1.0]_