$ cat hashicorp/month/2026-10-01.log
the month in review · October 2026
Consul patches four CVEs as Go bumps sweep repos
By RepoJournal · composed from the cited sources · human-reviewed weekly · methodology
Vault closes a plugin_directory escape and the Kubernetes provider rejects null namespace labels from anyone on 3.x.
fix sec vuln for morgan (GHSA-9f6g-j8ch-79g4) hashicorp/consul
The morgan access-log vulnerability, GHSA-9f6g-j8ch-79g4, reaches into a logging dependency that runs in the request path: before 1.12.1 the library does not escape the double quote in quoted access-log fields, so an attacker who controls the user-agent, referrer, URL or Basic-auth user can close the field early. If your Consul components sit behind Node-based tooling, this is the month to chec...
v0.10.1 hashicorp/consul-ecs
Consul ECS moves Go to 1.26.8 for CVE-2026-39821, CVE-2026-39822 and CVE-2026-42505, and pulls golang.org/x/crypto to v0.57.0 for CVE-2026-56854. Services on 0.10.x should move to 0.10.1; the fixes are toolchain-level, so nothing in your task definition changes.
v1.8.18 hashicorp/consul-dataplane
The dataplane bumps golang.org/x/net to v0.60.0 and Go to 1.26.9 for the same class of stdlib and HTTP/2 issues. Release 1.8.18 is a swap-in for anyone terminating Consul service mesh traffic outside Kubernetes.
fix(plugincatalog): enforce plugin_directory on catalog lookup (#19150) (#19207) hashicorp/vault
Catalog lookups now refuse to start a binary outside plugin_directory, closing the path where a plugin entry restored from a raft snapshot could point elsewhere. The change includes a raft snapshot restore regression test for both snapshot and snapshot-restore paths, so Vault upgrades should be tested against your existing catalog entries.
v6.68.0 hashicorp/terraform-provider-aws
namespace_v1 validates that metadata.labels and metadata.annotations entries are non-null strings, so plans that previously tolerated null values now fail. Drop the null entries or supply strings; entire maps may still be handled as the release notes describe. The AWS provider's 6.68.0 does the same kind of early validation for aws_docdb_cluster, rejecting more than 3 availability_zones at plan...
feat(camp): credential injection for external llm/mcp using Vault hashicorp/consul-k8s
Terminating gateways get opt-in credential injection across both the Helm and config-entry controller deployment paths, sourced from a Vault Agent rendering credentials in memory via a projected service-account token, or from a Kubernetes Secret. The companion fix keeps a credential-injection gateway healthy through Vault Agent restarts, since Kubernetes marks a pod NotReady when any single con...
v1.0.0 hashicorp/prewritten-terraform-policy-library
The first GA release of the prewritten policy library adds 151 policies for 546 total, spanning standards including AWS Foundational Security Best Practices. For teams running Sentinel against cloud estate baselines, this is the first version worth pinning rather than tracking.
v0.1.0 hashicorp/vagrant-registry-export
Alongside: an initial registry exporter for Vagrant, terraform-provider-tfe 0.82.0 supplying a replace-all tfe_registry_artifact_tag resource, ISO builder validation in the kubevirt plugin so packer validate fails before a build starts, and Vault UI gating that hides secrets engine actions the token cannot perform.
$ ls hashicorp/month/ # the briefings behind this review
Keep up with HashiCorp in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.
Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.