generated: '2026-08-27'
method: searched
source: https://github.com/openbao/openbao/blob/main/CHANGELOG.md ; https://openbao.org/community/release-notes/ ; https://api.github.com/repos/openbao/openbao/releases
name: OpenBao changelog
scheme: semver
current_version: 2.6.2
current_version_date: '2026-08-18'
locations:
- kind: changelog-file
  url: https://github.com/openbao/openbao/blob/main/CHANGELOG.md
  note: Categorised per release - SECURITY, CHANGES, FEATURES, IMPROVEMENTS, BUG FIXES, DEPRECATIONS - with every entry linked to its pull request.
- kind: release-notes
  url: https://openbao.org/community/release-notes/
  note: One page per minor series on the website; patch releases are folded into their minor's page.
- kind: github-releases
  url: https://github.com/openbao/openbao/releases
  note: Signed artifacts and SBOMs attached per release.
cadence: roughly monthly, with major and minor releases less frequent
entries:
- version: 2.6.2
  date: '2026-08-18'
  breaking: false
  security: true
  highlights:
  - 'SECURITY: internal operation types can no longer be dispatched from inline authentication and workflows, which had allowed token creation (GHSA-rh46-vc3j-w2w3).'
  - 'SECURITY: secrets/pki now enforces allowed_ip_sans_cidr on IP SANs taken from CSRs (GHSA-g892-p242-8g86).'
  - 'sys/leases: renew, revoke and revoke-prefix now propagate to the active node by default.'
  - 'sys/quotas: fixed the broken enable_rate_limit_audit_logging option.'
- version: 2.6.1
  date: '2026-07-22'
  breaking: false
  security: false
  highlights:
  - 'core/policies: PATCH support for modifying individual policy parameters.'
  - 'core/policies: fixed limit=0 and negative limits bypassing the pagination_limit ACL option.'
  - 'packaging/container: reverted removal of legacy non-OCI image labels for compatibility.'
- version: 2.6.0
  date: '2026-07-14'
  breaking: false
  security: true
  additions: true
  highlights:
  - 'Namespace Sealing - Shamir seal configuration per namespace, partitioning tenant storage with distinct key material.'
  - 'Auto Unseal plugins - a new kms plugin type, so unseal mechanisms ship as external binaries; several provider-specific built-in seals are announced for removal in v2.7.0.'
  - 'Workflows - new sys/workflows endpoints letting operators define simplified managed interfaces over the standard API, optionally executable unauthenticated.'
  - 'Authenticated root generation - /sys/generate-root-token replaces the deprecated unauthenticated endpoints.'
  - 'Distroless container images published as openbao-distroless.'
- version: 2.5.5
  date: '2026-06-17'
  breaking: false
- version: 2.5.0
  date: '2026-02-04'
  breaking: false
- version: 2.4.0
  date: '2025-08-28'
  breaking: false
- version: 2.0.0
  date: '2024-07-17'
  breaking: true
  highlights:
  - 'First stable release after the fork; introduced paginated LIST across engines and removed all storage backends except Raft (PostgreSQL and others were later re-added on the improved storage interface).'
window: 'Recent releases only. Full history: CHANGELOG.md.'