HashiCorp Vault v2.2.0: Breaking Changes, Critical ACL Fixes, and Upgrade Notes

Introduction

HashiCorp Vault v2.2.0, released October 15, 2026, is a release teams running Vault alongside Terraform should not skip. It bundles several breaking changes affecting containerized deployments, PostgreSQL storage backends, and PKI/ACME issuance, plus a long list of security fixes — several of them closing real ACL bypass vulnerabilities. This is the first version tracked for this project on terraformpilot.com, so there is no prior-version diff; treat this as a baseline hardening release to plan for.

What Is New

Breaking Changes

Container mlock() capability change. The cap_ipc_lock capability has been removed from the vault binary at build time to allow running in common container runtimes without extra privileges. This means Vault running in a container can no longer call mlock() to prevent memory from being swapped to disk. Operators must explicitly disable mlock in Vault's server configuration:

# vault-server.hcl
disable_mlock = true
 
listener "tcp" {
  address     = "0.0.0.0:8200"
  tls_disable = true
}
 
storage "raft" {
  path    = "/vault/data"
  node_id = "vault-1"
}

Because mlock is disabled, operators are advised to disable swap at the host/node level to avoid secrets being written to disk in a swap file. Note the release notes also mention setting cap_ipc_lock at build time elsewhere in the changelog; confirm the exact capability behavior for your container image tag before relying on mlock() in production.

UBI image package removal. The UBI-based container images no longer ship gnupg, openssl, and procps. Any entrypoint scripts, health checks, or sidecar tooling that shell out to these binaries inside the Vault container will break and need to be moved to a separate tool/sidecar image.

PostgreSQL storage backend auth preference change. The physical/postgresql backend now prefers Azure Workload Identity over Managed Identity (via go-pgmultiauth v1.1.0). If both are configured, Workload Identity wins, and existing Managed Identity-based setups may stop authenticating:

storage "postgresql" {
  connection_url = "postgres://vault:vault@localhost:5432/vault?sslmode=disable"
  # If Workload Identity is configured in the environment, it now takes
  # precedence over Managed Identity. Migrate explicitly if needed.
}

Teams on Azure using Managed Identity for the PostgreSQL storage backend must migrate to Workload Identity to avoid an outage after upgrading.

PKI/ACME SAN restriction. With the default sign-verbatim ACME directory policy, CSRs containing URI SANs, email SANs, or "Other" SANs are now rejected during finalization, since ACME challenges only validate DNS names and IP addresses. If your automation relies on ACME-issued certs with these SAN types, set the explicit opt-out (accepting the certs will contain unverified identity claims):

# config/acme (PKI secrets engine)
default_directory_policy = "sign-verbatim-unsafe"

Docker helper library migration. Internal SDK docker helpers moved from github.com/docker/docker to github.com/moby/moby, closing GHSA-x744-4wpc-v9h2 and GHSA-pxq6-2prw-chj9. This primarily affects plugin/test authors building against Vault's SDK, not typical Terraform operators.

Security Fixes

This release is heavy on security hardening. Highlights most relevant to operators managing ACLs and policies via Terraform:

• ACL policy-name case bypass (multiple fixes): Vault now normalizes the policies parameter to lowercase before evaluating allowed_parameters/denied_parameters, and fixes similar case-variant bypasses across AppRole, AWS, Azure, GCP, Kubernetes, SCEP, TPM role names, GitHub team/user mappings, certificate/CRL names, and userpass usernames. Okta groups, LDAP/RADIUS default case-insensitive mounts, and Enterprise SCIM clients are explicitly not covered — avoid combining wildcard allow with exact deny on those.
• LIST ACL trailing-slash bypass that could skip a more-specific deny rule is fixed.
• Policy traversal hardening: malformed legacy policy references with ./.. path-navigation segments are now ignored.
• Plugin catalog hardening: entries restored from raft snapshots, written via sys/raw, or replicated can no longer execute binaries outside plugin_directory.
• Identity templates: wildcards in rendered identity templates are now rejected.
• AWS auth caching fix: closes a potential authentication bypass caused by incorrect AWS client caching.
• Cert auth renewal: renewal now verifies the certificate matches the one attached to the session.
• Authorization header leakage: Vault tokens are now stripped from Authorization headers forwarded to plugin backends; the header is only forwarded if explicitly allow-listed.
• Numerous dependency CVE fixes: cloudflare/circl (CVE-2026-1229), edwards25519 (GO-2026-4503), go-jose (CVE-2026-34986), golang.org/x/net (GO-2026-4918), golang.org/x/crypto (GO-2026-6354/6355), grpc (GHSA-2v4p-qf9q-27wj), jackc/pgx migration to v5 (GHSA-j88v-2chj-qfwx, GO-2026-4518), go-getter (GHSA-92mm-2pjq-r785), apache/thrift, etcd client, and more.

Given the scope of ACL bypass fixes, teams managing Vault policies via terraform-provider-vault (vault_policy, vault_acl_* resources, auth backend roles) should treat this as a priority patch, especially if policies rely on exact-deny rules alongside wildcard allows.

Upgrade Steps

1. Pin the Vault server version in your deployment manifests/Helm values or container tag to 2.2.0.
2. If running Vault in a container, add disable_mlock = true to the server config and ensure swap is disabled on the host.
3. Audit any PostgreSQL storage backend configuration on Azure for Managed Identity vs Workload Identity before upgrading.
4. Review ACME-issued certificate SAN requirements; set default_directory_policy = "sign-verbatim-unsafe" in config/acme only if you understand the risk.
5. Update the Terraform Vault provider used to manage this Vault cluster to a version compatible with v2.2.0:

terraform {
  required_providers {
    vault = {
      source  = "hashicorp/vault"
      version = "~> 4.0"
    }
  }
}

6. Re-initialize and apply:

terraform init -upgrade
terraform plan
terraform apply

7. Review any ACL policies that mix wildcard allows with exact denies on Okta, LDAP/RADIUS default-case mounts, or Enterprise SCIM clients — these remain exposed to the case-variant bypass per the release notes.

Verify

Confirm the running server reports the new version and that mlock/config changes are applied:

vault status
vault version

Expected output should show Vault v2.2.0. For containerized deployments, confirm disable_mlock took effect by checking the server log on startup for the mlock warning/absence of mlock errors.

Conclusion

Vault v2.2.0 is primarily a security and hardening release: the ACL case-sensitivity and traversal bypass fixes are significant enough that any team enforcing deny rules should prioritize this upgrade. The breaking changes around container mlock, PostgreSQL identity auth, and PKI/ACME SAN validation require explicit configuration review before rolling this out — test in staging first, particularly if you run Vault containerized on Azure or issue ACME certificates with non-DNS/IP SANs.