Release Notes

v1.19.10

Highlights

• Replication: stricter authentication of secondary clusters
• Raft: the autopilot upgrade migration is no longer turned back on by an autopilot config without disable_upgrade_migration
• Updated base images to v4.0.0

Fixes

• Replication: a secondary connection is accepted only with the certificate issued to that secondary; a revoked certificate or the certificate of another secondary is rejected
• Replication: a secondary is accepted only while it exists, and its gRPC identity is bound to its connection
• Replication: revoking a secondary deletes all of its tokens, so they no longer authenticate requests
• Replication: fixed a panic when revoking a secondary that has no connection
• Raft: the default disable_upgrade_migration=true is kept when the stored autopilot config does not set it; previously upgrade migration was turned back on and could break the quorum during a StatefulSet rolling update

Security updates

• CVE-2026-78669
• CVE-2026-78663
• CVE-2026-97032
• CVE-2026-78659
• CVE-2026-78660

v1.19.9

Highlights

• fix: build hsm binary compatible with Astra SE 1.7
• stronghold-automatic: disable autopilot upgrade migration, fix unchecked type assertions
• Auto-unseal: skip auto init on initialized nodes, disable upgrade migration by default
• Security updates

Security updates

• CVE-2026-89322: ACL deny rules could be bypassed by changing the case of the path or adding whitespace, and denied_parameters by a non-canonical policy name
• CVE-2026-105816: plugin catalog entries restored from a snapshot or written via sys/raw could execute a binary outside plugin_directory
• CVE-2026-105818: PKI ACME default directory (sign-verbatim) issued certificates with URI, email and Other SANs not validated by ACME; such CSRs are now rejected, the previous behavior is available as sign-verbatim-unsafe

v1.19.8

Highlights

• Cross-site replication

v1.19.7

Highlights

• Licensing support
• Enterprise replication engine
• Managed keys: PKCS#11 HSM fixes, GOST/Kuznechik key generation, Yandex Cloud KMS
• Namespace isolation fixes for leases and tokens
• Security updates
• Important: if you previously connected another cluster in performance replication mode on v1.19+, the performance nodes have to be reconnected

New features

• Licensing, license settings in the Helm chart
• Customer name and perpetual expiration shown on the UI license page
• Promote and demote Raft voters
• Ability to drop replication index, Merkle tree and WALs
• CryptoPro seal: entropy augmentation support (GetRandom)

Improvements

• Rewrapping of legacy PKCS#11 seal format
• KV replication system view
• Health and readiness probes check the leader during rollout
• Ingress validation in the Helm chart
• Updated Helm library
• Automatic now handles SIGTERM
• Changed STRONGHOLD_CA to the common VAULT_CACERT
• Safe cleanup of the disabled Auto-Join feature
• Userpass password expiry handled in the UI login form
• Removed deprecated Vault 1.11 fallback
• New logos and updated UI translations

Fixes

• Deny cross-namespace lease and token lookup and revocation
• Fixed census restart on sealed and standby nodes
• Fixed PKCS#11 transit encryption and RSA-PSS
• Fixed namespace deletion in UI
• Fixed MFA method name and MFA method deletion
• Fixed TOTP QR code settings validation
• Fixed panics in password policies with an empty charset and in lease operations with non-string lease_id/token
• Fixed KV v2, mount tune, response wrapping and rotation config bugs
• Fixed goroutine leaks and deadlocks

Security updates

• CVE-2024-2048
• CVE-2024-2660
• CVE-2025-6037
• CVE-2026-53493
• Updated dependencies (containerd, go-git, grpc, golang.org/x/net, OpenTelemetry)

v1.19.6

Highlights

• Added the ability to specify password expiration times for userpass.
• Security updates

New features

• Added the ability to specify password expiration times for userpass.
• Self-service password change for userpass

Improvements

• Hide replication in UI and API when disabled
• Helm chart - disable replication for EE by default

Security updates

• CVE-2026-81870

v1.19.5

Highlights

• Kerberos auth plugin
• PKI support for KRB5 and IA5 SANs
• MFA support for OIDC, SAML, and WebAuthn in the UI
• Refactored autosnapshots into an enterprise-only snapshot manager
• Security updates

New features

• Kerberos auth plugin
• PKI support for KRB5 and IA5 SANs
• Allow MFA for OIDC, SAML, WebAuthn in UI

Improvements

• Refactored autosnapshots into an enterprise-only snapshot manager - moved Raft autosnapshot scheduling, storage, retention, S3 upload, and metrics into an EE-only package, added retry support and upload worker tuning, status migration, and broader test coverage
• Fixed snapshot metrics termination, updated dashboard, added alerts
• Optimized metrics memory usage
• Added SBOM generator and updater
• Updated helm chart to v0.1.1
• Updated trdl and trdl plugin
• Return a logical response instead of an internal server error on kv-repl write operations
• Fixed API description for MFA methods
• Deleted unused fields for the managed key API
• Deleted unused multifactor config fields
• DMT compliance

Fixes

• Fixed performance issue with LogShipper findSendElement
• Fixed deadlock in exportSnapshotAutoMetrics
• Fixed replication for non-transactional backends
• Fixed WAL GC

Security updates

• CVE-2026-81870
• CVE-2026-84445
• CVE-2026-53495
• CVE-2026-56855
• CVE-2026-84304
• CVE-2026-5807
• CVE-2026-56854
• CVE-2025-12044
• CVE-2025-6000
• CVE-2026-5051
• CVE-2025-6013
• CVE-2025-6203
• CVE-2026-4525
• CVE-2026-12624
• CVE-2026-5052
• CVE-2026-3605

v1.19.4

Highlights

• Updated base images to v2.1.4
• Added gitops and trdl plugins into UI
• Revert protos
• refactor mfa
• multifactor

v1.19.3

Highlights

• CVE-2026-17106

v1.19.2

Highlights

• Reduced application size by removing unused cloud KMS libraries
• Added validations for module configuration
• Minimum Deckhouse version raised to 1.76
• Disabled auto_join support for AWS, GCP, Azure and other cloud providers
• PKCS#11 and Yandex KMS code moved to enterprise wrapper
• Added key generation support for PKCS#11
• Disabled service-worker-registration unload, unsupported in newer browsers
• Invalid managed keys request parameters now return 400 instead of 500

Improvements

• Updated base images to v2.1.2
• Added bootstrap functions for d8-cli
• Updated OpenAPI specification, improving UX for the generated UI
• Added icons for webauthn, trdl and gitops plugins

Security updates

• Fixed CVE-2026-56864, updated golang.org/x/mod to v0.40.0

v1.19.1

Highlights

• Added replication status card on secondary
• Support for Vault EE storage with WALs
• Updated trdl

Improvements

• Migrated tests from docker/docker to moby/moby
• PKI DNS test migrated to new Docker API
• Updated base images to v1.3.26

Fixes

• Secondary cluster id now must be unique
• Autosnapshot configuration now not replicated to performance cluster

Security updates

• CVE-2026-71556, CVE-2026-71557

v1.19.0

Highlights

• Cross-cluster replication support
• Builtin gitops plugin for Enterprise Edition
• Builtin trdl plugin for Enterprise Edition
• Bootstrap CLI commands
• VEX attestation for Kubernetes images
• Support for Kubernetes Gateway API

v1.18.6

Highlights

• PKI - Allow set GOST key format to PKCS8
• Transit GOST export/import. Tests with OpenSSL

Improvements

• Added .helmingnore generator
• Split certutil by GOST build tag

Fixes

• Back to builtin GOST

Security updates

• Added Vex configuration

v1.18.5

Highlights

• GHSA-hrxh-6v49-42gf

Security updates

• GHSA-hrxh-6v49-42gf

v1.18.4

Highlights

• Security update

Security updates

• CVE-2026-46600, CVE-2026-56852
• Changed binary owner to root

Dependencies

• Yarn update from 3.5.0 to 4.17.0

v1.18.3

Highlights

• Admin namespace
• Stronghold CE can run with Enterprise storage (including without namespaces)
• WebAuthn passkey registration; autoregistration disabled by default, codes are used for registration
• Security updates: CVE fixes and tls_13_cipher_policy for GOST or AES preference

New features

• Added admin namespace
• Added ability to run Stronghold CE with Enterprise storage (can run without namespaces)
• API now returns namespaces which the provided token has access to
• Added registration code and registration URL for new WebAuthn passkeys; autoregistration disabled by default, codes are used for registration
• UI - Change password for userpass backend
• UI - Configure user lockout for ldap, userpass, approle
• Added tls_13_cipher_policy setting to prefer GOST or AES encryption algorithms

Improvements

• Added support for ingress pods, running in host network
• Disabled client-go rate limiting (DefaultQPS) for Kubernetes secrets engine
• Improved KV replication error wrapping
• Changed default password policy implementation for userpass auth
• DMT compliance
• Added changelog generator

Fixes

• Fixed log message on raft restore (NaN% to restore)
• Fixed dexclient deployment
• Fixed a bug where the specified MFA rules were not added when creating an MFA

Security updates

• CVE-2026-2303, CVE-2026-44973, CVE-2026-44740, CVE-2026-45571, CVE-2026-41579

Docs

• Added module subsystem
• Updated documentation links

Dependencies

• Updated base images to v1.3.4
• Updated webauthn to v0.2.1

v1.18.2

• Updated base images to v1.0.43
• UI - Fixed handling of empty password policy list
• UI - New sidebar and user menu
• Disabled ingress buffering
• Changed unsealer loglevel
• Moved kv-replication logic from core to kv-plugin
• Support for storage migration for HA installations
• Support nodeSelector configuration
• Support storageClass configuration
• Readiness probe optimisation
• Approle error related to IP address and CIDR mismatch no longer returns nil.
• Allow X-Forwarded-For headers from Ingress with mTLS client auth
• Added nil check into helper/pgpkeys/flag.go
• Possible DEREF_AFTER_NULL.EX auth.go

v1.18.1

• UI - Refactor the sidebar navigation
• UI - fixed password policy form saving
• UI - showing/hiding system log and audit log pages depends on token permissions
• UI - Fixed assert on sys/monitor
• UI - Hide empty sidebar sections by permissions
• UI - Hide EE features from CE API and UI
• UI - The Autosnapshots menu will be hidden if there are insufficient access rights
• Added system log viewer into UI
• Added sys/audit-monitor API path
• Flush audit monitor on core shutdown
• Terminate monitor session on core shutdown
• Updated base images to v1.0.17, go1.25.10
• Added extra in-cluster services to NO_PROXY env variable
• KV replication CA now in PEM format
• Use system CA storage for kv replication when VAULT_CACERT is set
• Improved fuzzing. Fixed API response codes on invalid user data.
• DMT compliance
• Added remapper method for d8 cli
• CI - SKIP_SETCAP for Docker tests
• CI - Makefile for dev runs and static builds
• Changed module requirements - needs Deckhouse >= 1.72
• CVE-2026-25645, CVE-2025-66418, CVE-2025-66471, CVE-2026-21441, CVE-2026-34986, CVE-2026-39883, CVE-2026-32952, CVE-2026-41506, CVE-2026-41889

v1.18.0

• Managed Keys for key material in external trusted systems without storing private keys inside Stronghold. Supported for Transit, PKI, and SSH secrets engines.
• Managed key support in Yandex KMS and PKCS#11.
• User authentication via an external SAML 2.0 Identity Provider using the Web SSO profile.
• Web UI for managing KV mount replication settings.
• PKI supports single-element RDNs in distinguished names for compatibility with OpenSSL / Microsoft CA.
• Audit devices support record filtering and excluding specific fields.
• Snapshot verification via stronghold operator raft snapshot inspect.
• Added ability to manage max_ttl parameter for ACME certificates.
• Improved compatibility with Auto-Snapshots Vault Enterprise — snapshot configuration is preserved when migrating from Vault Enterprise.
• CVE GHSA-jqcq-xjh3-6g23, CVE-2026-33186, CVE-2026-33487, CVE-2025-15558

v1.17.0

• Added WebAuthn support — passwordless authentication (FIDO2/Passkeys).
• Support for external Stronghold plugins running on DKP.
• Namespace lock features and a UI to manage them.
• Web UI support for the LDAP secrets engine.
• Added Yandex KMS as a seal backend.
• Extended Agent usage scenarios.
• Added support for raft nodes in non-voter mode.
• Refined deployment scenarios on arbiter node groups and test cluster parameters.

v1.16.0

• Added support for namespaces (Namespaces).
• Multi-factor authentication (MFA) with TOTP and Multifactor.
• Deckhouse Stronghold CE (Community Edition) available for free installation.
• Web UI support for managing OIDC roles, AppRole, and password policies.
• Added replication metrics.
• Added SealWrap — additional encryption for the most sensitive internal data on top of Stronghold’s standard cryptographic barrier.
• Added CryptoPro seal wrapper for scenarios using Russian cryptography.
• Web UI has fuller Russian localization and a dark theme.
• Added ClickHouse support and a web UI to work with it.
• Added TLS 1.3 with GOST ciphers Magma and Kuznyechik.
• Added support for GOST 34.10-2012 X.509 certificates.

v1.15.0

• Scheduled backup of Raft snapshots to S3 or the filesystem with API-driven management.
• Extended KV replication capabilities.
• Improved web UI.
• Automatic unseal via HSM/PKCS#11, including Rutoken ECP 3.0 support.

v1.1.0

• Automatic unseal with keys held in Stronghold node memory
• Russian-language user interface
• Listed in the Russian software registry, entry No. 22339 dated 24.04.2024
• Integration with the platform secrets delivery module `secrets-store-integration``

v1.0.0

• Deployment as a DKP module
• Integration with platform DEX authentication