Vault v2.2.1 and v2.1.2: Root Aliases, ACL Casing and ACME SAN Changes

Release v2.2.1: Root-Policy Aliases Are Now Rejected #

The v2.2.1 release notes state that a cache-key collision could let policy-name aliases resolve to the immutable root policy, and that root-policy aliases are now rejected at entity, group, token, authentication-response and agent-registry policy assignment. The notes give "./root" and "a/../root" as examples of aliases that were accepted and are now refused. Any automation that assigns policies by alias should be checked for these forms.

Because the rejection happens at assignment time, a failing request is the first signal that an alias is root-equivalent. Teams that build policy names from user input or templates should validate them before they reach these endpoints. The notes describe the rejection but not how existing assignments containing such aliases are handled, so a review of stored assignments is the only way to confirm that none remain.

Container trust store changes #

The same release lists two security changes to container images. The containers/alpine image upgrades ca-certificates-bundle to 20261020-r0 to distrust eMudhra intermediate chains. The containers/UBI image explicitly disallows emSign Root CA and Comodo AAA Services in its CA trust store, which the notes also describe as a way to distrust eMudhra intermediate chains. Certificates that chain to these roots will no longer be trusted inside those images, so services that call external endpoints through them should be tested.

Go toolchain and SPIFFE auto auth #

Under CHANGES, v2.2.1 bumps the Go version to 1.27.3 to resolve CVE-2026-111943. Teams that build Vault from source should use this toolchain version. Under IMPROVEMENTS, the agent gains an auto auth SPIFFE method. The notes do not describe its configuration, so readers should consult the agent documentation before adopting it.

Bug fixes in v2.2.1 #

• Enterprise role-based quotas now determine roles stored as form-data.
• Enterprise tpmgroup membership updates made through the by-name endpoint now take effect on the active node.
• Enterprise SCIM POST /Users adopts an unmanaged entity whose name matches, instead of returning 409; the name conflict check applies only when a new entity is created.
• Enterprise managed keys work for MACs, and HMAC transit key checks allow managed keys.
• Transit CMAC and datakey generation work after rotation with the Rotate with Algorithm Change endpoint.
• MSSQL default user revocation quotes identifiers and parameterizes principal lookups, and default password rotation quotes the username and escapes the password.
• storage/mssql and storage/mysql escape configured SQL identifiers.
• The UI MFA form breadcrumbs render correctly in the enforcement section.

Release v2.1.2: Stricter ACL Matching and ACME Validation #

The v2.1.2 release notes list a breaking change in PKI: ACME finalization with the default sign-verbatim directory policy now rejects CSRs containing URI SANs, email SANs or Other SANs. The notes explain that ACME challenges only verify DNS names and IP addresses, so the other SAN types are never validated. Teams that request certificates through ACME should inspect their CSR templates for these fields.

Operators who need the previous behaviour can set default_directory_policy to "sign-verbatim-unsafe" in config/acme. The notes say the resulting certificates may contain unverified identity claims, so this option trades validation for compatibility. Treat it as a temporary decision and record it as an accepted risk rather than a default.

Mixed-case ACL rules now match lowercase names #

Under CHANGES, v2.1.2 states that ACL and Sentinel EGP rule paths for AppRole, AWS, Azure, GCP, Kubernetes, SCEP and TPM roles, GitHub mappings, certificates, CRLs, policy names and userpass usernames are matched against the lowercased resource name. A rule such as auth/approle/role/MyRole no longer matches, and must be written as auth/approle/role/myrole. The same lowercased value is what Sentinel RGP and EGP policies see as request.path.

Existing deny rules using mixed-case resource names will fail open (become allow-all) after upgrade until rewritten with lowercase names.

Release v2.1.2

This is the change with the widest effect on access control. A deny rule that was written in mixed case stops matching, which means the protected resource becomes reachable until the rule is rewritten. The notes say that External auth and secret plugins are not affected and continue to receive original casing, so the rewrite is needed only for the internal backends and policies listed.

Policy names and plugin catalog checks #

Under CHANGES, v2.1.2 validates policy names by path segment. Empty names and names containing . or .. are rejected for new writes and assignments, while / and \ remain supported. Legacy traversal-style references are not applied during ACL construction, which the notes say can reduce effective token permissions. The notes advise auditing and renaming affected policies before upgrading.

The plugin catalog now checks each entry's command against plugin_directory whenever it is used. An entry that resolves outside the directory, including through a symlink, is refused with "plugin command is outside of configured plugin directory", and mounts using it are skipped at startup while their data is kept. Those plugins must be registered again with binaries inside plugin_directory.

Security hardening and other v2.1.2 items #

• Enterprise ACL parameter restrictions prevent policy-name canonicalization bypasses.
• Plugin catalog entries restored from a raft snapshot, written through sys/raw, or replicated can no longer run a binary outside plugin_directory.
• Request-time ACL construction ignores malformed legacy policy references containing . or .. segments.
• Exact-deny ACL policies are no longer bypassed by case-variant names for several backends, certificate and CRL names, policy names and userpass usernames.
• Enterprise SPIFFE login gains a CLI handler, and PKI roles gain extra_subject_names_oids for additional OID subject name components.
• token_bound_cidrs validation works with /128 blocks for AppRole role and secret ID.
• Monitoring > Client Count requests from a child namespace include the root-namespace header again.

The v2.1.2 notes state that Okta group names, LDAP and RADIUS names in default case-insensitive configuration, and Enterprise SCIM client names are not covered by the exact-deny fix. The notes advise avoiding a wildcard allow combined with an exact deny on those mounts and paths.

Upgrade Checklist: What to Verify Before and After #

1. Search policies for empty names and names containing . or .. segments, and rename them, as the v2.1.2 notes advise before upgrading.
2. Find ACL and Sentinel RGP/EGP rules that use mixed-case resource names for the listed backends, and rewrite them in lowercase before upgrading to avoid fail-open deny rules.
3. Review ACME configurations for CSRs containing URI, email or Other SANs, and decide whether to remove them or set sign-verbatim-unsafe.
4. Confirm each plugin binary sits inside plugin_directory, and re-register any that do not.
5. Apply the v2.2.1 release and search entities, groups, tokens, auth responses and agent-registry assignments for root-equivalent aliases such as "./root".
6. If you use the containers/alpine or containers/UBI images, rebuild or pull the updated images and test connections to services whose certificates chain to the distrusted roots.
7. If you build Vault from source, use Go 1.27.3 as stated in the v2.2.1 CHANGES.
8. If you use Enterprise features listed in the notes, such as SCIM, managed keys, tpmgroup or MSSQL, check the corresponding fixes against your configuration.

The sources do not describe a rollback procedure, so test these changes in a non-production cluster before applying them to production.