From c5ff1a3fcad5aa324dbef69c9e361b633f98769d Mon Sep 17 00:00:00 2001 From: Lutz Finsterle Date: Sat, 22 Aug 2026 09:12:14 +0200 Subject: [PATCH] Upgrade OpenBAO 2.5.5 -> 2.6.2 Picks up 6 security fixes across 2.6.0/2.6.2, notably GHSA-xp3c-3jw3-4vcr (LIST bypassing an explicit deny from a wildcard grant). Checked the 2.6.x breaking changes against this deployment before upgrading: - Identity-template hardening (+ * / , now rejected in template values): no {{ }} templating in any policy, and every pki/ssh role has *_template = false. Unaffected. - Container default user changed root -> openbao (uid 100): the raft volume at /openbao/file is already uid 100 and the config bind-mount is world-readable :ro, so no chown fixup was needed. Both containers now run as uid=100(openbao). Unaffected. - Cloud KMS + pkcs11 seals become external plugins in 2.7.0: this uses the transit seal, which stays built in. Unaffected. - physical/file deprecated in 2.7.0: storage is raft. Unaffected. - Pre-v2.5.0 corrupt identity groups purged on unseal: cluster was created on 2.5.5, and the `family` group survived. Unaffected. - Arch-specific tags (2.6.x-arm64) no longer published: compose uses the plain multi-arch tag. Unaffected. Upgrade order was unsealer first (recreate, manually unseal 1-of-1 shamir, confirm the autounseal transit key is readable), then main, which auto-unsealed via transit. Cluster IDs preserved on both. Verified after: all 13 mounts, 4 auth methods and 14 policies intact; KV read, PKI issue, SSH CA sign and transit encrypt all work through their scoped tokens; backup token still 403s outside its scope; raft snapshots succeed on 2.6.2; HTTPS via Traefik serves 2.6.2 with a trusted chain. Note: sys/seal-status now reports `commit_date` instead of `build_date`. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01NFtVLA7VVqXL5G2S18c4Jk --- docker-compose.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index 78645e8..6025430 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -1,6 +1,6 @@ services: openbao: - image: openbao/openbao:2.5.5 + image: openbao/openbao:2.6.2 container_name: openbao restart: unless-stopped # The image entrypoint already runs `bao server -config=/openbao/config` @@ -32,7 +32,7 @@ services: # Minimal sidecar instance that provides transit auto-unseal for the main # node above. Shamir-sealed itself; only reachable on the internal network. openbao-unsealer: - image: openbao/openbao:2.5.5 + image: openbao/openbao:2.6.2 container_name: openbao-unsealer restart: unless-stopped command: server