$ the-wire · showcase
Vault resolves GO-2026-6354 via x/crypto bump, adds export key management and Bob Review CI gates
By RepoJournal · Filed · About HashiCorp · Composed from the cited sources · methodology
1 person shipped this
Vault upgraded golang.org/x/crypto to v0.56.0 to resolve GO-2026-6354, shipped an ENT-only CRUD endpoint at /pki/export, and landed opt-in Bob Review CI gates alongside two UI and attribution backports.
Vault upgraded golang.org/x/crypto to v0.56.0 to resolve GO-2026-6354 and GO-2026-6354, per the commit signed off by Ryan Cragun [1]. This is the one change in the batch with a named vulnerability attached; anyone tracking Go dependency advisories should confirm their build pulls the same version.
Vault Enterprise gained a CRUD endpoint for export key management under PKI, exposed as LIST/WRITE/READ/DELETE at /pki/export [2]. The commit describes it as "ENT-only export key management which is a CRUD endpoint", and the tests cover write, read, list, delete, and the auth check path [2]. Callers on Vault Enterprise can now manage export keys through the API surface rather than only through whatever internal path existed before; the endpoint is not present on CE builds.
The CI side picked up opt-in Bob Review gates for vault-enterprise, including an unlabeled trigger to avoid a stale check status when a label is removed, and automatic cleanup of the receipt file when clear-bob-receipt is added [3]. Two backports also landed into ce/main: the UI entities list route restructuring, which removes the identity parent route and resolves model lookup to a definite item type [4], and the parent namespace ID attribution work, which adds ParentNamespaceID to mount attribution metrics and cert attribution and wires it through the MountAttributionProto conversion [5]. The attribution change matters for anyone reading namespace-scoped metrics that previously lacked a parent identifier.
Action items
- → Confirm Vault builds pull golang.org/x/crypto v0.56.0 to clear GO-2026-6354 hashicorp/vault [immediate]
- → Review /pki/export CRUD behavior on Vault Enterprise before exposing it in automation hashicorp/vault [plan]
- → Recheck namespace-scoped mount and cert attribution metrics for the new parent_namespace_id field hashicorp/vault [monitor]
References
- [1] [VAULT-49982] go: resolve GO-2026-6354 and GO-2026-6354 by upgrading golang.org/x/crypto to v0.56.0 ↗ hashicorp/vault
- [2] Add export key management CRUD endpoint for PKI ( Ent only) (#18285) (#18473) ↗ hashicorp/vault
- [3] Add opt-in Bob Review CI gates (#18098) (#18422) ↗ hashicorp/vault
- [4] Backport [UI] Entities List Updates into ce/main (#18475) ↗ hashicorp/vault
- [5] Backport Vault 48689 parent namespace id attribution into ce/main (#18213) ↗ hashicorp/vault
