v1.21.2

hashicorp/vaultv1.21.2Jan 7, 2026by hc-github-team-es-release-engineering

AI Summary

Vault 1.21.2 is a patch release with performance improvements, bug fixes, and dependency updates including Go version bump to 1.25.5 and security updates to golang/x/crypto. The release also includes container image format changes and improvements to rotation manager responsiveness.

Key Highlights

Core: Bump Go version to 1.25.5
Go security updates to resolve GHSA-f6x5-jh6r-wrfv, GHSA-j5w8-q4qc-rx2x, GO-2025-4134 and GO-2025-4135
Container images now exported using compressed OCI image layout
Rotation manager checks queue every 5 seconds instead of 10 seconds for improved responsiveness
secrets-sync enterprise: Added force_delete flag for emergency destination deletion

New Features

secrets-sync (enterprise): Added support for boolean force_delete flag to allow deletion of destinations when associations cannot be unsynced
rotation: Ensure rotations for shared paths only execute on Primary cluster's active node
rotation: Ensure rotations for local paths execute on cluster-local active node
sdk/rotation: Prevent rotation attempts on read-only storage
secrets/pki: Avoid loading issuer information multiple times per leaf certificate signing

Full Release Notes

## 1.21.2
### January 07, 2026

CHANGES:

* auth/oci: bump plugin to v0.20.1
* core: Bump Go version to 1.25.5
* packaging: Container images are now exported using a compressed OCI image layout.
* packaging: UBI container images are now built on the UBI 10 minimal image.
* secrets/azure: Update plugin to v0.25.1+ent. Improves retry handling during Azure application and service principal creation to reduce transient failures.
* storage: Upgrade aerospike client library to v8.

IMPROVEMENTS:

* core: check rotation manager queue every 5 seconds instead of 10 seconds to improve responsiveness
* go: update to golang/x/crypto to v0.45.0 to resolve GHSA-f6x5-jh6r-wrfv, GHSA-j5w8-q4qc-rx2x, GO-2025-4134 and GO-2025-4135.
* rotation: Ensure rotations for shared paths only execute on the Primary cluster's active node. Ensure rotations for local paths execute on the cluster-local active node.
* sdk/rotation: Prevent rotation attempts on read-only storage.
* secrets-sync (enterprise): Added support for a boolean force_delete flag (default: false). When set to true, this flag allows deletion of a destination even if its associations cannot be unsynced. This option should be used only as a last-resort deletion mechanism, as any secrets already synced to the external provider will remain orphaned and require manual cleanup.
* secrets/pki: Avoid loading issuer information multiple times per leaf certificate signing.

BUG FIXES:

* core/activitylog (enterprise): Resolve a stability issue where Vault Enterprise could encounter a panic during month-end billing activity rollover.
* http: skip JSON limit parsing on cluster listener.
* quotas: Vault now protects plugins with ResolveRole operations from panicking on quota creation.
* replication (enterprise): fix rare panic due to race when enabling a secondary with Consul storage.
* rotation: Fix a bug where a performance secondary would panic if a write was made to a local mount.
* secret-sync (enterprise): Improved unsync error handling by treating cases where the destination no longer exists as successful.
* secrets-sync (enterprise): Corrected a bug where the deletion of the latest KV-V2 secret version caused the associated external secret to be deleted entirely. The sync job now implements a version fallback mechanism to find and sync the highest available active version, ensuring continuity and preventing the unintended deletion of the external secret resource.
* secrets-sync (enterprise): Fix issue where secrets were not properly un-synced after destination config changes.
* secrets-sync (enterprise): Fix issue where sync store deletion could be attempted when sync is disabled.
* ui/pki: Fix handling of values that contain commas in list fields like `crl_distribution_points`.