Update docker.io/hashicorp/vault Docker tag to v2.2.1
No problems upgrading the Hashicorp Vault Docker container with a Docker compose yaml file within Portainer and by means of Portainer DevOps resp. GitOps with dependency update facilitated by Mend's Renovate Bot.
| Package | Update | Change |
|---|---|---|
| docker.io/hashicorp/vault | patch | 2.2.0 → 2.2.1 |
Release Notes
hashicorp/vault (docker.io/hashicorp/vault)
v2.2.1
October 22, 2026
SECURITY:
- containers/alpine: Upgrade ca-certificates-bundle to
2026102-r0 to distrust eMudhra intermediate chains. - containers/UBI: explicitly disallow emSign Root CA and Comodo AAA Services in the CA trust store to distrust eMudhra intermediate chains.
- core/policy: Fixed a cache-key collision vulnerability that could cause policy-name aliases to resolve to the immutable root policy. Root-policy aliases are now explicitly rejected at entity, group, token, authentication-response, and agent-registry policy assignment boundaries. Previously accepted root-equivalent policy aliases (e.g., "./root", "a/../root") are now rejected.
CHANGES:
- core: Bump Go version to 1.27.3 to resolve CVE-2026-111943.
IMPROVEMENTS:
- agent: Add auto auth SPIFFE method.
BUG FIXES:
- core/quotas (enterprise): Fixed a bug where role-based quotas would fail to determine roles where the role is stored as
form-data. - identity (enterprise): Fix updates to tpmgroup membership not taking effect on active node when the tpmgroup by-name endpoint is used for the update. Reads showed the change applied to storage, but the inmem index wasn't updated.
- identity/scim (enterprise): Fix
POST /Usersreturning 409 instead of adopting an unmanaged entity whose name matches theuserName, such as afterunlink-entity. Adoption now depends only on the matching alias, and the name conflict check applies only when a new entity is created. - managed-keys (enterprise): Fix wrapper error in using managed keys for MACs
- secrets/database/mssql: Safely quote database and user identifiers during default user revocation and parameterize principal lookups, so that logins whose names contain characters outside the database code page are removed rather than left disabled. Default password rotation now quotes the username and escapes the password.
storage/mssql, storage/mysql: Escape configured SQL identifiers when constructing storage queries. - transit (enterprise): Fix key check to allow use of managed keys for HMAC
- transit (enterprise): Fix error with using CMAC keys after rotation from an HMAC key using the Rotate with Algorithm Change endpoint
- transit (enterprise): Fix error with using managed keys for datakey generation after rotation using the Rotate with Algorithm Change endpoint
- ui: Fix MFA form breadcrumbs rendering in enforcement section, updated radio cards to use HDS
