OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. The OpenBao community intends to provide this software under an OSI-approved open-source license, led by a community run under open governance principles.
What's new in 2.7.1
SECURITY
core: Prevent disclosure of tls_acme_eab_mac_key from sys/config/state/sanitized. GHSA-3237-j65r-m5rp. [GH-4148]
core/audit: The unauthenticated "Root Token Generation" and "Rekey" endpoints (which are disabled by default) returned their response, even if audit logging failed. GHSA-q74w-hv5x-6hxf. [GH-4148]
auth/approle: Ensure Secret ID cannot be used for authentication after expiration but before tidy is called. GHSA-7m59-mp95-w6ph. [GH-4148]
auth/approle: Fix incorrect JSON-decode path when parsing login requests with form data bodies. GHSA-5v22-543h-wg96. [GH-4148]
auth/cert: Fix omission of TLS connection propagation when calculating role-based quota. GHSA-5v22-543h-wg96. [GH-4148]
auth/kubernetes: Ensure Service Account JWT is validated on renewal, preventing post-revoke usage. GHSA-gf3j-hm38-jhh5. [GH-4148]
CHANGES
packaging: Update the default server config included in Linux packages to use the pebbledb backend instead of the removed file backend. [GH-4088]
BUG FIXES
core/barrier: Persist updates to key rotation config on changes to disabled field. [GH-4107]
core/grpc-invalidation: Ensure dispatcher lifecycle correctly handles active, standby state changes without locking conflicts. Resolves GRPC invalidation drops and pre-seal active node hangs. [GH-4117]
storage/raft: Fix auto_join breaking on providers that include ports with their discovered addresses. [GH-4113]
storage/postgresql: Switch to pg_last_wal_replay_lsn() for applied index value checks. [GH-4118]
api: Honor the error backoff interval after failed LifetimeWatcher renewal attempts. [GH-4036]
What's Changed
docs(guides): add migration guide for File to PebbleDB storage backends on Kubernetes (#4092 by @pree) backported by @pree in #4109
Update default config included in linux packages (#4088 by @satoqz) by @satoqz in #4121
KeyRotationConfig equals() method should compare disabled field (#4107 by @wslabosz-reply) backported by @satoqz in #4122
Use persistent JobManager in GRPC Invalidation (#4117 by @cipherboy) backported by @satoqz in #4123
Fix Auto Join with provider-specified port (#4113 by @satoqz) backported by @satoqz in #4124
Honor backoff after failed LifetimeWatcher renewals (#4036 by @haxonittech) backported by @satoqz in #4125
Swap to pg_last_wal_replay_lsn() (#4118 by @cipherboy) backported by @satoqz in #4126
Ensure release artifact signatures are verified on creation (#3838 by @cipherboy) backported by @satoqz in #4128 …
Yes. OpenBao is free and open-source software released under the MPL-2.0 license.
What is the latest version of OpenBao?
The latest version is 2.7.1, released on Oct 1, 2026.
Is it safe to download OpenBao?
The download button links to the official installer published on github.com, the same file Windows Package Manager installs. You can verify the downloaded file by comparing its SHA-256 checksum with e3b3335918a78cc730bb07014c4191c80fe5eb376f3f1a708185acf8bc0109ac.
Which Windows versions does OpenBao support?
OpenBao runs on Windows and is available for 64-bit (x64), ARM64 systems.
How do I uninstall OpenBao?
Open Settings › Apps › Installed apps, find OpenBao and select Uninstall. From the command line, run winget uninstall --id=OpenBao.OpenBao -e.
