Password and Secrets Management Release Notes

Release notes for password managers and secrets management tools

Get this feed:

Products (16)

Latest Password and Secrets Management Updates

Oct 16, 2026
Date parsed from source:
Oct 16, 2026

First seen by Releasebot:
Oct 17, 2026
Bitwarden iOs by Bitwarden

Password Manager 2026.10.0 (3551)

Bitwarden iOs releases clearer sync error messaging with a retry option, requires text for text sends, and includes passkey, accessibility, and bank account fixes alongside general improvements.
Overview

Clearer sync error message with an option to try again

Various under-the-hood bug fixes and improvements

What's Changed

Feature Development

[PM-43334] feat: Add a sync-specific failure dialog to the vault list by @KatherineInCode in #3042

[PM-43440] feat: Require "Text to share" for text send by @tomhartnett-bw in #3083

🐛 Bug fixes

[PM-43874] fix: Moves "Use this password/passphrase/username" button by @morganzellers-bw in #3056

[PM-32809] fix: Bank Account drop-down order and filter by @morganzellers-bw in #2983

[pm-32809] fix: Add shared VoiceOver a11y infra for toggles and spelled-out values by @morganzellers-bw in #3024

[pm-32809] fix: Bank Account accessibility fixes by @morganzellers-bw in #3026

[PM-44190] fix: Passkey assertions do not work on V2 accounts by @quexten in #3076

⚙️ Maintenance

[PM-39767] refactor: Split BillingStateService out of StateService by @KatherineInCode in #3047

[PM-39767] refactor: Add userId parameters to Premium state accessors by @KatherineInCode in #3051

Fix for slack message parsing by @mpbw2 in #3061

[BRE-2283] Use the supplied release notes verbatim for the App Store by @pixman20 in #3075

📦 Dependency Updates

[deps]: Lock file maintenance by @renovate[bot] in #2767

🎨 Other

Fillassist swapped to our internal url by @alex8bitw in #3049

New Contributors

@alex8bitw made their first contribution in #3049

Full Changelog: v2026.9.1-bwpm...v2026.10.0-bwpm

Builds Source: https://github.com/bitwarden/ios/actions/runs/37054704613
Original source
Oct 16, 2026
Date parsed from source:
Oct 16, 2026

First seen by Releasebot:
Oct 17, 2026
Bitwarden iOs by Bitwarden

Authenticator 2026.10.0 (898)

Bitwarden iOs releases an update with a sync failure dialog, required text for text sends, and fixes for passkeys, bank account fields, and accessibility, alongside other bug fixes and improvements.
Overview

Various under-the-hood bug fixes and improvements

What's Changed

Feature Development

[PM-43334] feat: Add a sync-specific failure dialog to the vault list by @KatherineInCode in #3042

[PM-43440] feat: Require "Text to share" for text send by @tomhartnett-bw in #3083

🐛 Bug fixes

[PM-43874] fix: Moves "Use this password/passphrase/username" button by @morganzellers-bw in #3056

[PM-32809] fix: Bank Account drop-down order and filter by @morganzellers-bw in #2983

[pm-32809] fix: Add shared VoiceOver a11y infra for toggles and spelled-out values by @morganzellers-bw in #3024

[pm-32809] fix: Bank Account accessibility fixes by @morganzellers-bw in #3026

[PM-44190] fix: Passkey assertions do not work on V2 accounts by @quexten in #3076

⚙️ Maintenance

[PM-39767] refactor: Split BillingStateService out of StateService by @KatherineInCode in #3047

[PM-39767] refactor: Add userId parameters to Premium state accessors by @KatherineInCode in #3051

Fix for slack message parsing by @mpbw2 in #3061

[BRE-2283] Use the supplied release notes verbatim for the App Store by @pixman20 in #3075

📦 Dependency Updates

[deps]: Lock file maintenance by @renovate[bot] in #2767

🎨 Other

Fillassist swapped to our internal url by @alex8bitw in #3049

New Contributors

@alex8bitw made their first contribution in #3049

Full Changelog: v2026.9.1-bwa...v2026.10.0-bwa

Builds Source: https://github.com/bitwarden/ios/actions/runs/37054707691
Original source
All of your release notes in one feed

Join Releasebot and get updates from Bitwarden and hundreds of other software products.

Create account
Get updates with:
Oct 15, 2026
Date parsed from source:
Oct 15, 2026

First seen by Releasebot:
Oct 16, 2026
Vault by Hashicorp

v2.2.0

Vault releases a major update centered on AI agent security, with an Agent Registry and OAuth-based access, plus broad advances in PKI, identity, secrets management, and the UI. It also delivers extensive security hardening and breaking changes across authentication, policies, and containers.

October 15, 2026
BREAKING CHANGES:
containers: Remove cap_ipc_lock capability on vault at build time to allow running Vault in common container runtimes. Vault in containers will no longer be able to call mlock() to lock memory. Operators should set disable_mlock = true in Vault's configuration. Runtime operators are advised to disable swapping to guarantee data safety.
containers: The following packages have been removed from UBI based container images: gnupg, openssl, procps.
containers: set cap_ipc_lock capability on vault at build time. Container runtimes will need to add IPC_LOCK capabilities when running the vault container.
physical/postgresql: breaking change - PostgreSQL storage backend authentication now prefers Azure Workload Identity over Managed Identity. Update go-pgmultiauth to v1.1.0. Existing Managed Identity-based PostgreSQL configurations may stop working if Workload Identity is configured. Affected users must migrate PostgreSQL authentication to Workload Identity.
pki: ACME finalization with the default sign-verbatim directory policy now rejects CSRs that contain URI SANs, email SANs, or Other SANs. ACME challenges only verify DNS names and IP addresses; those SAN types are never validated and must not appear in issued certificates. Operators who require the previous behaviour can set default_directory_policy = "sign-verbatim-unsafe" in config/acme, accepting that the resulting certificates may contain unverified identity claims.
sdk/helpers/docker: Migrate docker helpers from github.com/docker/docker to github.com/moby/moby. This was necessary as github.com/docker/docker is no longer maintained. Resolves GHSA-x744-4wpc-v9h2 and GHSA-pxq6-2prw-chj9.
SECURITY:
Upgrade cloudflare/circl to v1.6.3 to resolve CVE-2026-1229
Upgrade filippo.io/edwards25519 to v1.1.1 to resolve GO-2026-4503
acl: Fix privilege-escalation vulnerability where a denied_parameters constraint on the policies request field could be bypassed by submitting a mixed-case policy name (e.g. "Super-Admin" instead of "super-admin"). Vault now normalizes the policies parameter to lowercase before evaluating allowed_parameters/denied_parameters constraints.
api/auth/gcp: Update go.opentelemetry.io/otel/sdk to fix CVE-2026-39883.
api/auth: Update github.com/go-jose/go-jose to fix security vulnerability CVE-2026-34986 and GHSA-78h2-9frx-2jm8.
api: Update golang.org/x/net to resolve GO-2026-4918
auth/aws: Fix an issue where a user may be able to bypass authentication to Vault due to incorrect caching of the AWS client
auth/cert: Ensure that the certificate being renewed matches the certificate attached to the session.
auth/radius: Added case_insensitive_names toggle to prevent username collisions and enable case-insensitive user handling.
core (enterprise): Prevent policy-name canonicalization bypasses in ACL parameter restrictions.
core/acl: Fix LIST ACL bypass where a trailing-slash request could skip a more-specific deny rule.
core/identity: Reject wildcards in rendered identity templates.
core/plugin: Fix plugin catalog entries restored from a raft snapshot, written through sys/raw, or replicated being able to run a binary outside plugin_directory.
core/policy: Harden request-time ACL construction to ignore malformed legacy policy references containing path-navigation segments (. or ..) so traversal-style names are never resolved or applied.
core: Correctly remove any Vault tokens from the Authorization header when this header is forwarded to plugin backends. The header will only be forwarded if "Authorization" is explicitly included in the list of passthrough request headers.
core: Fixed a bypass of exact-deny ACL policies where case-variant AppRole, AWS, Azure, GCP, Kubernetes, SCEP, or TPM role names, GitHub team or user policy mapping keys, certificate or CRL names, ACL/RGP/EGP policy names, or userpass usernames could evade the deny and be resolved by the backend to the same protected resource. Okta group names, LDAP and RADIUS names on mounts left in their default case-insensitive configuration, and Enterprise SCIM client names (identity/scim/client/<name>, where a case-variant write overwrites the existing client) are not covered by this fix and remain subject to the same bypass; avoid combining a wildcard allow with an exact deny on those mounts and paths.
core: Resolve GHSA-j88v-2chj-qfwx by removing our dependency on github.com/jackc/pgx/v3 and github.com/jackc/pgx/v4
core: Resolve GO-2026-4518 and GHSA-jqcq-xjh3-6g23 by upgrading to github.com/jackc/pgx/v5
core: Update github.com/Azure/go-ntlmssp to fix security vulnerability v0.1.1.
core: Update github.com/apache/thrift to fix security vulnerability GHSA-wf45-q9ch-q8gh
core: Update github.com/apache/thrift to v0.24.0 to fix security vulnerability GHSA-8wv5-x4w7-5gww.
core: Update github.com/aws/aws-sdk-go-v2/ to fix security vulnerability GHSA-xmrv-pmrh-hhx2.
core: Update github.com/go-jose/go-jose to fix security vulnerability CVE-2026-34986 and GHSA-78h2-9frx-2jm8.
core: Update github.com/hashicorp/go-getter to fix security vulnerability GHSA-92mm-2pjq-r785.
core: Update github.com/jackc/pgx/v5 to fix security vulnerability GHSA-j88v-2chj-qfwx.
core: Update go.etcd.io/etcd/client/pkg/v3 to v3.7.1 to fix security vulnerability GO-2026-6107.
core: Update go.opentelemetry.io/otel/sdk to fix CVE-2026-39883.
core: Update golang.org/x/crypto to v0.56.0 to fix security vulnerabilities GO-2026-6354 and GO-2026-6355.
core: Update golang.org/x/net to resolve GO-2026-4918"
core: Update google.golang.org/grpc to v1.83.2 to fix security vulnerability GHSA-2v4p-qf9q-27wj.
core: Update software.sslmate.com/src/go-pkcs12 to v0.7.2 to fix security vulnerability GO-2026-5052.
core: Use constant-time recovery token comparison.
core: Validate both path and file_path cannot be empty for requests to sys/audit/{path}
core: Reject URL-encoded paths that do not specify a canonical path.
http: Add configurable max_token_header_size listener option (default 8 KB) to bound the size of authentication token headers (X-Vault-Token and Authorization: Bearer), preventing a potential denial-of-service attack via oversized header contents. The stdlib-level MaxHeaderBytes backstop is also now set on the HTTP server. Set max_token_header_size = -1 to disable the limit.
identity/scim (enterprise): The identity/entity/merge endpoint now rejects requests that involve any SCIM-managed entity, preventing privileged operators from bypassing SCIM ownership guardrails to transfer aliases, group memberships, or policies across SCIM boundaries.
identity: Prevent the entity batch-delete endpoint (identity/entity/batch-delete) from deleting the underlying storage of entities that belong to another namespace.
identity: Entity name updates now reject mismatched id or external_id selectors to prevent retargeting updates to a different entity.
sdk: Resolve GHSA-j88v-2chj-qfwx by removing our dependency on github.com/jackc/pgx/v3 and github.com/jackc/pgx/v4
sdk: Resolve GO-2026-4518 and GHSA-jqcq-xjh3-6g23 by upgrading to github.com/jackc/pgx/v5
sdk: Update github.com/Azure/go-ntlmssp to fix security vulnerability v0.1.1.
sdk: Update github.com/go-jose/go-jose to fix security vulnerability CVE-2026-34986 and GHSA-78h2-9frx-2jm8.
sdk: Update github.com/jackc/pgx/v5 to fix security vulnerability GHSA-j88v-2chj-qfwx.
sdk: Update golang.org/x/net to resolve GO-2026-4918"
secrets/spiffe (enterprise): Ensure template values are properly escaped.
transform (enterprise): Add appropriate db specific quoting and escaping.
ui: Upgrade dompurify to 3.4.0
ui: Disable scarf analytics for ui builds.
vault/sdk: Upgrade cloudflare/circl to v1.6.3 to resolve CVE-2026-1229
vault/sdk: Upgrade go.opentelemetry.io/otel/sdk to v1.40.0 to resolve GO-2026-4394
CHANGES:
License: Add Agentic IAM terms to client licensing model and update terms for Vault Platform licensing model.
api: Removed the hcp_link_status and hcp_link_resource_ID fields from the sys/seal-status response.
audit: A new top-level key called supplemental_audit_data can now appear within audit entries of type "response" within the request and response data structures. These new fields can contain data that further describe the request/response data and are mainly used for non-JSON based requests and responses to help auditing. The audit-non-hmac-request-keys and audit-non-hmac-response-keys apply to keys within supplemental_audit_data to remove the HMAC of the field values if so desired.
auth/alicloud: Update plugin to v0.24.0
auth/azure: Update plugin to v0.25.1
auth/cf: Update plugin to v0.24.0
auth/gcp: Update plugin to v0.24.1
auth/jwt: Update plugin to v0.27.1
auth/kerberos: Update plugin to v0.18.0
auth/kubernetes: Update plugin to v0.25.0
auth/oci: Update plugin to v0.22.0
auth/saml: Update plugin to v0.9.0
auth/token: JWT revocation via auth/token/revoke-self and auth/token/revoke-accessor is no longer supported. auth/token/revoke and auth/token/revoke-orphan now require the full JWT to revoke an OAuth JWT and reject the internal stored JWT ID form. Non-JWT Vault token behavior is unchanged.
cli: vault operator diagnose no longer runs an HCP Link connectivity check, and vault status no longer shows HCP Link status.
cli/status: vault status no longer forces the root namespace when querying seal status. It now respects the namespace set via VAULT_NAMESPACE or the -namespace flag, consistent with other CLI commands.
core/acl: LIST requests with a trailing slash now correctly respect more-specific deny policies. Previously, a deny on path "kv/" { deny } could be bypassed for LIST kv/private/ if a broader allow path "kv/" also existed. Policies relying on the previous (incorrect) behavior may now be denied.
core/managed-keys (enterprise): The response to API endpoint GET sys/managed-keys/:type/:name now
returns an array of string values for key usages, rather than an array of integer values. The strings used are 'encrypt' (1), 'decrypt' (2), 'sign' (3), 'verify' (4), 'wrap' (5), 'unwrap' (6), 'generate_random' (7), and 'mac' (8).
core/oauth-resource-server (enterprise): The write response for sys/config/oauth-resource-server/:name now returns HTTP 200 with the full profile object instead of HTTP 204 with an empty body. Validation warnings are returned alongside the profile data rather than in place of it.
core/plugin: Plugin catalog entries are now checked against plugin_directory whenever they are used, not only at registration. An entry whose command resolves outside the directory, including through a symlink, is refused with plugin command is outside of configured plugin directory, and mounts that use it are skipped at startup while keeping their data. Such plugins must be registered again with their binary inside plugin_directory.
core/policy: Vault now validates policy names with segment-aware checks. Empty names and names containing . or .. path segments are rejected for new policy writes and assignments, while names containing / and \ remain supported. During request-time ACL construction, legacy traversal-style policy references are not applied (treated as invalid and unresolved), which can reduce effective token permissions. Operators should audit and rename affected policies before upgrading.
core/raft: Limited concurrent retry-join workers to 20. Any further retry-join attempts while 20 are in progress will result in an error (too many concurrent raft retry joins in progress).
core: ACL and Sentinel EGP rule paths targeting a specific AppRole, AWS, Azure, GCP, Kubernetes, SCEP, or TPM role, GitHub team or user policy mapping key, certificate or CRL name, ACL/RGP/EGP policy name, or userpass username are now matched against the lowercased resource name, since these backends resolve those names case-insensitively. A rule written with a mixed-case resource name (for example auth/approle/role/MyRole) no longer matches requests for that resource and must be rewritten using the lowercase name (auth/approle/role/myrole). The lowercased form is also what Sentinel RGP and EGP policies observe as request.path, so policy rules that compare that value against a mixed-case path (for example request.path is "auth/approle/role/MyRole") must be updated as well. External auth and secret plugins are not affected by this normalization and continue to receive requests with their original casing. Existing deny rules using mixed-case resource names will fail open (become allow-all) after upgrade until rewritten with lowercase names.
core: Bump Go version to 1.27.1.
core: Require sudo capability for sys/mounts/auth/<path>/tune, matching sys/auth/<path>/tune.
core: Vault now rejects paths that are not canonical, such as paths containing double slashes (path//to/resource)
core: Vault will now redirect non-canonicalized paths (containing /./, /../, or //) to a cleaned path, instead of rejecting these requests
core: bump github.com/hashicorp/cap to v0.12.0
core: remove support for duplicate attributes in HCL configuration files and policy definitions. Parsing HCL with duplicate attributes now always fails, and the VAULT_ALLOW_PENDING_REMOVAL_DUPLICATE_HCL_ATTRIBUTES environment variable that previously restored the legacy behavior has been removed.
core: secondary DR requests can now be authenticated using a root token generated on the primary.
core: sys/generate-root and sys/replication/dr/secondary/generate-operation-token endpoints are now authenticated by default, with the old unauthenticated behaviour enabled by setting the new HCL config key enable_unauthenticated_access to include the value "generate-root" or "generate-operation-token" respectively.
core: sys/rekey endpoints are now authenticated by default, with the old unauthenticated behaviour enabled by setting the new HCL config key enable_unauthenticated_access to include the value "rekey".
core: Removed support for HCP Link, which connected self-managed Vault clusters to the HashiCorp Cloud Platform (HCP). Vault no longer starts an HCP Link connection, and the cloud stanza in the server configuration no longer has any effect and will be unrecognized.
database/couchbase: Update plugin to v0.17.0
database/elasticsearch: Update plugin to v0.21.0
database/mongodbatlas: Update plugin to v0.18.0
database/redis-elasticache: Update plugin to v0.9.1
database/redis: Update plugin to v0.9.0
database/snowflake: Update plugin to v0.17.0
http: Return 431 status code instead of 400 when token header size validation fails.
identity/scim (enterprise): Added "allow_group_adoption" toggle to allow or forbid a SCIM client from adopting groups.
identity/scim (enterprise): Added a check for case-duplicate identity resources which, if detected, will cause the SCIM operation to fail with an error message. To deduplicate identities, please use the force-identity-deduplication activation flag.
identity/scim (enterprise): Loading SCIM clients will now test for and remove duplicate client names. SCIM clients are now properly case insensitive.
identity/scim: Remove the SCIM activation flag; SCIM v2 endpoints are now always available without prior activation
identity: Require sudo capability to invoke the identity entity merge API endpoint (identity/entity/merge).
license utilization reporting (enterprise): Manual reporting bundles generated by vault operator utilization have a changed format. Notably they contain an array of snapshot_records instead of snapshots. The decoded_snapshot field in each record contains the human-readable data that was previously in the snapshots array.
mfa/duo: Upgrade duo_api_golang client to 0.2.0 to include the new Duo certificate authorities
oauth-resource-server: Prevent issuer_id from being mutated after OAuth Resource Server profile creation. Operators must delete and recreate profiles to change the issuer_id.
oauth-resource-server: Prevent unique_id_claim from being mutated after OAuth Resource Server profile creation. Operators must delete and recreate profiles to change the unique_id_claim.
oauth-resource-server: The OAuth Resource Server feature no longer requires activation via the sys/activation-flags/oauth-resource-server/activate endpoint.
oauth-resource-server: Update OAuth Resource Server config to include custom claim options for the token's unique identifier and actor.
packaging: Container images are now exported using a compressed OCI image layout.
packaging: UBI container images are now built on the UBI 10 minimal image.
secrets/ad: Update plugin to v0.23.0
secrets/alicloud: Update plugin to v0.23.0
secrets/azure: Update azure enterprise secrets plugin to include static roles.
secrets/azure: Update plugin to v0.28.3+ent
secrets/gcp: Update plugin to v0.25.0
secrets/gcpkms: Update plugin to v0.25.0
secrets/keymgmt: Update plugin to v0.20.1+ent
secrets/kmip: Update plugin to v0.20.0
secrets/kubernetes: Update plugin to v0.14.0
secrets/kv: Update plugin to v0.27.0
secrets/ldap (enterprise): Static roles will be migrated from a plugin-managed queue to the Vault Enterprise Rotation Manager system. Static role migration progress can be checked and managed through a new static-migration endpoint. See the LDAP documentation for more details on this process.
secrets/mongodbatlas: Update plugin to v0.18.0
secrets/openldap: Update plugin to v0.19.3+ent
secrets/pki: sign-verbatim endpoints no longer ignore basic constraints extension in CSRs, using them in generated certificates if isCA=false or returning an error if isCA=true
secrets/ssh: RSA key sizes are now limited to a maximum size of 8192 bits addressing CVE-2026-39829
secrets/terraform: Update plugin to v0.15.0
secure-plugin-api: Update to v0.2.0
storage: Upgrade aerospike client library to v8.
ui/secrets: Secrets engines url paths renamed from '/secrets' to '/secrets-engines'
ui: Remove HCP Link status indicator following deprecation of HCP Link.
ui: Remove ability to bulk delete secrets engines from the list view.
FEATURES:
Transform FF1 Support (Enterprise): Add support for the NIST approved FF1 format preserving encryption (FPE) algorithm, and a new rewrap operation to assist transitioning
from FF3-1 to FF1.
PKI External CA (Enterprise): A new plugin that provides the ability to acquire PKI certificates from Public CA providers through the ACME protocol
AI Agent Support (Beta/Enterprise): Adds beta support for first-class AI agents. Adds an Agent Registry to register agents, and adds support for using Vault as an OAuth resource server for registered agent entities. When configured, allows OAuth 2.0 JWTs to be used to directly authorize requests to Vault, without needing a Vault token.
AI Agent Support (Enterprise): Vault's support for first-class AI agents is now Generally Available. Adds an Agent Registry to register agents, and adds support for using Vault as an OAuth resource server for registered agent entities. When configured, allows OAuth 2.0 JWTs to be used to directly authorize requests to Vault, without needing a Vault token.
Agent Registry UI (Enterprise): Adds a new Agentic Security section to the primary navigation with an Agent Registry page where operators can view, search, and manage registered AI agents, their associated Vault entities and aliases, assigned policies, and operational status.
Automatic DNS-01 Challenge Fulfillment for PKI External CA: Integrate with the following DNS providers for automatic DNS-01 challenge fulfillment: AWS Route53, Azure DNS, Google Cloud DNS, and BIND and other RFC2136-compliant servers.
Automatic TLS Certificate Reloading: TCP listeners accept a new tls_reload_interval option. When set, Vault periodically checks tls_cert_file and tls_key_file for changes and reloads the certificate automatically, so rotated certificates are picked up without restarting the node or sending SIGHUP.
Billing metrics dashboard: Create a new billing dashboard with responsive layout to display metric data.
Dark Mode (beta): Added dark mode support to the Vault UI. Users can now choose between light, dark, or system-preferred themes from the Appearance section in user preferences.
Health Check Manager: Adds a dedicated system to manage and monitor the health of Vault Enterprise plugins. This provides operators and platform engineers with an explicit mechanism to verify connectivity and authentication against external systems.
IBM PAO License Integration: Added IBM PAO license support, allowing usage of Vault Enterprise with an IBM PAO license key. A new configuration stanza license_entitlement is required in the Vault config to use an IBM license. For more details, see the License documentation.
KMIP Bring Your Own CA: Add new API to manage multiple CAs for client verification and make it possible to import external CAs.
LDAP Secrets Engine Enterprise Plugin: Add the new LDAP Secrets Engine Enterprise plugin. This enterprise version adds support for self-managed static roles and Rotation Manager support for automatic static role rotation. New plugin configurations can be set as "self managed", skipping the requirement for a bindpass field and allowing static roles to use their own password to rotate their credential. Automated static role credential rotation supports fine-grained scheduled rotations and retry policies through Vault Enterprise.
LDAP Secrets Engine Rotate on Read (Enterprise): Add rotate-on-read support for static roles in the LDAP secrets engine, triggering an immediate credential rotation on read, with a configurable cooldown period and per-role override.
Login MFA TOTP Self-Enrollment (Enterprise): Simplify creation of login MFA TOTP credentials for users, allowing them to self-enroll MFA TOTP using a QR code (TOTP secret) generated during login. The new functionality is configurable on the TOTP login MFA method configuration screen and via the enable_self_enrollment parameter in the API.
ML-DSA Support in PKI: Add support for post-quantum signatures with ML-DSA keys in the PKI secrets engine.
Namespace (Enterprise): Add operator_namespace_path to listener configuration to restrict HTTP access to a specific namespace subtree, enabling per-listener namespace isolation.
PKI BYOK CA Key Migration (enterprise): A new sudo-protected POST /pki/keys/:uuid/export endpoint wraps a CA private key with a caller-supplied public key using RSA-OAEP-SHA256, ECDH-ES, or ML-KEM. The destination Vault instance can import the blob via POST /pki/keys/import using wrapped_key and export_key_hmac. Export events are recorded as tamper-evident audit records keyed on the SPKI fingerprint of the CA key, which survive delete-and-reimport cycles and surface as warnings on issuer reads.
PKI PKCS#12 and JKS Support: Adds support for PKCS#12 (PFX) and Java keytool (JKS) certificate bundles to relevant PKI endpoints. Bundles are returned as base64-encoded, password-protected files.
PKI Secure Key Export (Enterprise): Add export key management CRUD endpoint (LIST/WRITE/READ/DELETE /pki/export) to support secure CA private key migration between PKI mounts.
Plugins (Enterprise): Allow overriding pinned version when creating and updating database engines
Plugins (Enterprise): Allow overriding pinned version when enabling and tuning auth and secrets backends
Rotation Policies: Add support for automated rotation parameters to rotation policies
SCIM 2.0 Identity Provisioning Beta (Beta/Enterprise): Adds beta support for Vault to act as a SCIM 2.0 server, allowing external management of Vault entities, aliases and groups.
SCIM Token Support (Enterprise): Add support for SCIM tokens via token_type=scim with per-client active token limits and max TTL ceilings.
SLH-DSA support for Hybrid sign/verify in Transit engine (Enterprise): Add support for SLH-DSA as the PQC component for Hybrid sign/verify operations. This is compatible with both ECDSA (p-256, P-384, P-521) and Ed25519.
Secrets Sync UI: Added Workload Identity Federation (WIF) support in the UI for AWS, Azure, and GCP sync destinations
Secrets Sync UI: Adds support to sync Database static roles
Secrets Sync UI: Implements AWS KMS key ID and regional KMS keys support
Secrets Sync UI: Implements GCP replica regions and encryption support
Secrets engines UI catalog revamp: Redesigned view of secrets engines catalog when enabling an engine, adding more engine descriptors & ability to search the catalog for the ideal engine to utilize.
Telemetry Consent Banner: Add a consent banner allowing users to accept or decline anonymous usage data collection to help improve Vault.
Template Integration for PublicPKICA: Vault Agent templates are now automatically re-rendered when a PKI external CA certificate is issued or renewed.
Terraform Code Generator: Adds TFVP code snippets to ACL policy surfaces (show, flyout and form), powered by a new reusable mapping engine for generating HCL from Vault API payloads.
Transit Crypto Agility: Allows customers to alter cryptographic primitives in transit engine. This adds new endpoints /transit/keys/:name/algorithm and /transit/keys/:name/import_version.
UI ACL Policies intro: Onboarding intro which provides feature context to users.
UI Authentication methods intro: Onboarding intro which provides feature context to users.
UI Namespace Wizard (Enterprise): Onboarding wizard which provides advice to users based on their intended usage and guides them through namespace creation.
UI Policy Generator (Enterprise): Adds policy generator flyout to KV V2 and PKI secrets engines prepopulated with relevant API requests for each page.
UI Secret engines intro: Onboarding intro which provides feature context to users.
UI TLS Certificate login: Add UI login support for the TLS certificate (cert) authentication.
UI: Hashi-Built External Plugin Support: Recognize and support Hashi-built plugins when run as external binaries
UI: Hashi-Built External Plugin Support: Support external plugin version updates via the GUI.
UI: Mount versioned external plugins: Adds ability to mount previously registered, external plugins and specify a version when enabling secrets engines.
UI: PKI External CA: Adds views to inspect ACME orders (active orders by role, lookup by order ID or certificate), ACME account, DNS provider, and role configurations, and retrieve cached certificates.
User Preference Settings: Added a User Preferences page (/vault/<cluster>/user-preferences) accessible from the account menu. Includes a Data & Privacy section with a telemetry consent toggle that persists per-browser in localStorage.
Vault Agent: ACME protocol support: Add support to natively support Public CA ACME workflows
Vault Client (Enterprise): Introduce vault-client, a smaller binary that includes Vault Agent, Vault Proxy, and the CLI commands for interacting with a Vault server, but not the server itself. It is available as zip bundles and Alpine container images.
oauth-resource-server: Added oauth_denylist.entries.gauge metric to monitor active OAuth token denylist entries.
secrets-sync (enterprise): Added support for the Database secrets engine as a sync source, allowing static-role credentials to be synced to external destinations.
oauth-resource-server: Added OAuth Protected Resource Metadata endpoint (RFC 9728) for publishing authorization_details types and enabling automated discovery by Authorization Servers via /.well-known/oauth-protected-resource
secrets-sync: implemented workload identity federation support for secrets sync flows.
secrets: Added ability to view secrets in YAML format
IMPROVEMENTS:
Secrets Engines UI improvement: Updated configuration views and added tune support for configurations across all compatible secrets engines.
Sidebar UI improvement: Add top navbar, update sidebar navigation structure, and update page headers.
Update github.com/dvsekhvalnov/jose2go to fix security vulnerability CVE-2025-63811.
activity (enterprise): Add a cumulative namespace client count API at sys/internal/counters/activity/cumulative. For each namespace in the response it returns the sum of its own client counts and that of all its child namespaces.
agent-registry (enterprise): Add a local flag to agent registrations. When local=true, registrations are not replicated to other performance replication clusters and are kept local to the current cluster.
agent-registry (enterprise): Removed the restriction that disallowed the use of 'deny' in ceiling policies, resulting in request errors.
agent/pkiexternalca: Replace go.uber.org/atomic with sync/atomic (stdlib) for atomic boolean operations in the pkiexternalca package.
api: Add start_month and end_month parameters to /sys/billing/overview endpoint to allow querying billing data for specific time ranges.
api: Add a SHA256 sum field to the json list response for external plugins.
api: Add migration_done_at_epoch to sys/seal-status response.
api: Added sudo-permissioned sys/reporting/scan endpoint which will output a set of files containing information about Vault state to the location specified by the reporting_scan_directory config item.
auth/aws: Added missing OpenAPI metadata for the aws auth endpoints
auth/aws: Migrate the AWS auth method, its public API client (api/auth/aws), and the shared login-data helper (internal/awsutil/v2) from AWS SDK for Go v1 to v2.
auth/cert: Support login via x-forwarded cert headers even with tls disabled on the vault listener.
auth/jwt (OAuth RS): Add EdDSA/Ed25519 support to the OAuth resource server JWT validation path. Ed25519 public keys can now be registered via public_keys and supported_algorithms = ["EdDSA"] is now accepted at configuration time and runtime.
auth/jwt: Add parameter constraint fields (allowed_parameters, denied_parameters, required_parameters) to vault:path_access RAR type schema and metadata for complete OAuth Resource Authorization Request support
auth/ldap: Require non-empty passwords on login command to prevent unauthenticated access to Vault.
auth/okta: Add missing OpenAPI path description for the /auth/{okta_mount_path}/verify/{nonce} path.
auth/okta: Added missing OpenAPI metadata for auth Okta plugin endpoints
auth/spiffe (enterprise): Add SPIFFE login cli handler.
auth/token: Add global denylist for revoking OAuth JWTs to prevent authorization of specific tokens across all namespaces.
auth/token: Add the revoke-oauth endpoint to revoke an external OAuth token by its issuer and unique ID.
auth/token: auth/token/revoke-accessor now supports revoking JWT tokens by accessor
ci (enterprise): Upload build stage duration metrics to Instana for CI observability.
cli: Move spiffe and tpm CLI login methods to CE.
command/agent: Migrate AWS client from aws-sdk-go v1 to aws-sdk-go-v2.
config/listener: logs warnings on invalid x-forwarded-for configurations.
consumption-billing: Add a new sys/billing/config endpoint to allow configuration of billing data retention (min 13 months, max 6 years).
consumption-billing: Add billing tracking for LDAP and OpenLDAP service account
library sets as part of both HWM role metrics and running-count product usage metric.
consumption-billing: Add billing tracking for OS Local Account static roles to support consumption-based billing metrics and high-water mark (HWM) tracking.
consumption-billing: Added consumption billing metrics for GCP KMS data protection operations.
consumption-billing: Added consumption billing metrics for OIDC tokens.
consumption-billing: Added consumption billing metrics for PKI External CA certificates.
consumption-billing: Added consumption billing metrics for SPIFFE JWT tokens.
consumption-billing: Adds a new sys/billing/overview endpoint that returns current and previous month consumption billing metrics. Accessible via API client method client.Sys().BillingOverview().
consumption-billing: Enabled sys/billing/overview endpoint in admin namespace.
consumption-billing: Float64 values returned by sys/billing/overview are now rounded to 4 decimal places.
consumption-billing: Increased billing data retention from 2 months to 37 months. The /sys/internal/billing/overview API endpoint now returns 37 months of historical consumption billing data by default.
consumption-billing: Mount attribution data is now stored for consumption billing metrics. The retention period can be configured via the new attribution_retention_months parameter on sys/billing/config (0–72 months, default 37). Setting to 0 disables attribution storage and immediately wipes all existing attribution data.
consumption-billing: The /sys/internal/billing/overview API endpoint now always returns all metric types in the response, even when their values are zero. This ensures consistent response structure for easier client-side parsing.
core (enterprise): Make deadlock detection in sealwrap configurable by adding "sealwrap" to existing configuration detect_deadlocks.
core (enterprise): Sanitized config now shows kms_library config.
core (enterprise): Add OAuth resource server authorization_details type discovery endpoints and align vault:path_access claim matching semantics with path/capabilities evaluation; discovery endpoints are unauthenticated.
core (enterprise): Add disallow_env_vars in PKCS#11 to allow per key configuration for RSA encryption algorithm.
core (enterprise): Add sys/config/ui/checklist-state endpoint to persist and retrieve onboarding checklist progress.
core (enterprise): Add an endpoint at sys/config/oauth-resource-server/id/:config_id to read oauth resource server profiles by config_id
core (enterprise): Add common_criteria_mode feature_flags setting which limits listener TLS cipher suites.
core (enterprise): Added a new telemetry metric vault.core.license.termination_time_epoch.
core (enterprise): Make OAuth resource server JWT typ validation more permissive for tokens from IdPs such as Okta by allowing a missing typ header, while restricting present typ values to at+jwt, application/at+jwt, and JWT.
core (enterprise): allow secretmounts' seal wrap configuration to be changed via auth and/or mount tune instead of only at mount creation.
core (enterprise): enable rotation manager to send rotation information required by plugin backends during registration and rotation operations. This allows plugin backends to have the necessary context for managing their rotation state effectively.
core (enterprise): enable rotation manager to use configurable retry policies to limit the retry behavior for rotation entries and include an orphaning mechanism to handle entries that exceed the maximum retry attempts.
core (enterprise): improve rotation manager error handling by implementing a backoff when re-queueing failed rotations
core (enterprise): Ameriolate sealwrap lock contention for core paths.
core/acl: Adds a global deny_slash_in_templated_path configuration option to reject the presence of slashes in rendered identity templates in policies, defaulting to false.
core/census: Add vault.secret.engine.transform.role.count product usage metric reporting the number of Transform secret engine roles.
core/census: Add product usage metrics vault.auth.method.cert.role.count, vault.auth.method.cert.crl.count, vault.auth.method.spiffe.role.count, and vault.auth.method.scep.role.count reporting the number of Cert auth roles and CRLs, SPIFFE auth roles, and SCEP auth roles across all namespaces and mounts, and vault.auth.method.spiffe_enabled reporting whether the SPIFFE auth method is enabled.
core/census: Add product usage metrics reporting the number of Transform secret engine transformations, templates, alphabets, and stores, and KMIP secret engine scopes, scope roles, and CAs.
core/identity: Add two new fields to the alias API, external_id and issuer. These fields do not inherently do anything meaningful, and are part of a future feature.
core/identity: Adds a global deny_slash_in_templated_path configuration option to reject the presence of slashes in rendered identity templates in policies, defaulting to false.
core/managed-keys (enterprise): Allow GCP managed keys to leverage workload identity federation credentials
core/managed-keys/PKCS#11 (enterprise): Add PKCS#11 backend parameter rsa_oaep_hash to use for RSA-OAEP encryption with CKM_RSA_PKCS_OAEP mechanism.
core/managed-keys/PKCS#11 (enterprise): Providing a non-empty value for one field while the other is already saved is rejected. To switch addressing modes, you must explicitly clear the old field by sending it as an empty string ("") in the same request alongside the new value.
core/managed-keys/PKCS#11 (enterprise): slot and token_label are now strictly enforced as mutually exclusive identifiers for an HSM token
core/metrics: Reading and listing from a snapshot are now tracked via the vault.route.read-snapshot.{mount_point} and vault.route.list-snapshot.{mount_point} metrics.
core/oauth-resource-server (enterprise): Read and list responses for sys/config/oauth-resource-server now include a mount_accessor field containing the pre-assembled synthetic accessor string (oauth-resource-server_<namespace_id>_<config_id>). This is the accessor reported for profile-backed aliases in identity and audit output, and the value used to select those aliases in templated policies.
core/oauth-resource-server (enterprise): Support setting an alternate claim name in an OAuth Resource Configuration specifying where to read authorization details in a presented JWT. New option "authorization_details_claim" defaults to "authorization_details".
core/oauth-resource-server (enterprise): The list response for sys/config/oauth-resource-server now includes a key_info map keyed by profile name, each entry carrying config_id and mount_accessor. Listed profile names are now sorted, and profiles whose details cannot be read are reported in a response warning.
core/oauth-resource-server: Support data locality for OAuth Resource Server configuration profiles (non-replicated profiles).
core/seal (enterprise): Make it possible for new nodes to join a cluster configured with Seal High Availability.
core/seal (enterprise): Update Oracle Cloud library to enable seal integration with newer regions.
core/seal: Enhance sys/seal-backend-status to provide more information about seal backends.
core: Add a ui_settings configuration stanza with a ui_telemetry option, surfaced to the UI via the sys/internal/ui/settings endpoint, that gates anonymous UI usage telemetry.
core: Automatically write a goroutine dump to a temp directory on shutdown (SIGTERM/SIGINT). The output directory can be overridden with VAULT_STACKTRACE_FILE_PATH, and the dump can be suppressed with the config field disable_goroutine_trace_dump.
core: Enforce OAuth authorization_details vault:path_access constraints with strict path/capabilities and parameter-level controls.
core: Improve goroutine termination during preseal.
core: check rotation manager queue every 5 seconds instead of 10 seconds to improve responsiveness
dockerfile: container will now run as vault user by default
events (enterprise): Add event notifications support for lease events.
events (enterprise): Forward event notifications from primary to secondary clusters
events: Add VAULT_EVENT_NOTIFICATIONS_BOUNDED_QUEUE_SIZE environment variable to configure bounded event queues for event notification subscribers. Set to a positive integer (e.g., 16) to enable buffered channels of that size (maximum 1000). This prevents resource exhaustion in deployments with high subscriber counts, but comes at the cost of the potential for subscribers to miss events. Defaults to 0 (unbuffered) for backward compatibility.
events/sqs: Migrate SQS event subscription plugin from aws-sdk-go v1 to aws-sdk-go-v2.
go: update to golang/x/crypto to v0.45.0 to resolve GHSA-f6x5-jh6r-wrfv, GHSA-j5w8-q4qc-rx2x, GO-2025-4134 and GO-2025-4135.
identity/entity-alias: Added profile_name and config_id fields as shortcuts to resolve an OAuth Resource Server profile when creating entity aliases, without requiring a mount_accessor. Resolving a profile also binds the alias to that profile's issuer, which OAuth Resource Server authentication requires. The fields are mutually exclusive with each other and with mount_accessor.
identity/scim (enterprise): Add POST identity/scim/client/<client-name>/link-entity endpoint to re-establish SCIM ownership over an unmanaged entity, restoring managed aliases and group memberships.
identity/scim (enterprise): Add POST identity/scim/client/<client-name>/link-group and POST identity/scim/client/<client-name>/unlink-group admin endpoints. link-group transfers ownership of an existing unmanaged Vault identity group to the named SCIM client; all current group members must already be owned by that client. unlink-group removes SCIM ownership from a group the client currently owns, returning it to unmanaged status.
identity/scim (enterprise): Add POST identity/scim/client/<client-name>/unlink-entity endpoint to remove the SCIM ownership link from an entity without deleting it.
identity/scim (enterprise): Add allow_user_adoption field to SCIM client configuration. When set to true, a POST /Users request whose userName matches an existing login alias will adopt the pre-existing entity rather than returning a conflict. Defaults to false.
identity/scim (enterprise): Add support for attributes and excludedAttributes query parameters on SCIM User and Group endpoints, allowing callers to request a subset or exclusion of attributes in responses per RFC 7644.
identity/scim (enterprise): Added filtering support to the GET /scim/v2/Users and GET /scim/v2/Groups endpoints per RFC 7644. Supported filters: userName eq, externalId eq, active eq, and meta.lastModified gt/ge/lt/le for Users; displayName eq and meta.lastModified gt/ge/lt/le for Groups. Unsupported filter expressions return HTTP 400. ServiceProviderConfig now advertises filter.supported: true.
identity/scim (enterprise): Fix Group PATCH to support filtered member paths of the form members[value eq "uuid"] for add and replace operations, matching the path format already supported for remove. This resolves an Okta error ("unsupported path") during Group Push membership updates. Group ownership mismatches now return 403 Forbidden (previously 404 Not Found); attempting to add/replace members owned by a different SCIM client now returns 403 (previously 400 with a not found-style detail).
identity/scim (enterprise): Improve SCIM User and Group listing endpoint performance by using prefix sort instead of a separate sort pass.
identity/scim (enterprise): Renamed the unlink_aliases consent parameter to unlink_secondary_aliases and separated the response payload into unlinked_main_alias_id and unlinked_secondary_alias_ids.
identity/scim (enterprise): The 2.1 User extension now supports a client-managed aliases attribute. SCIM clients can push an array of {mount_accessor, name} entries on POST, PUT, and PATCH /Users to create, rename, or remove secondary aliases on an entity beyond the primary alias controlled by alias_mount_accessor.
identity/scim (enterprise): Update PATCH operations on scim/v2/Users to allow multiple modifications in the same patch call, support for patch operations on user metadata and name in addition to active status, and allow specifying path value in patch operations
identity/scim: New SCIM extensions for Users and Groups are supported, but mutually exclusive with User metadata extension.
identity/scim: POST /Users for a client with alias_mount_accessor now adopts a pre-existing entity when the userName matches an existing login alias on the target mount, instead of failing with a conflict.
identity/scim: Unmanaged groups (no SCIM owner) are now visible to all SCIM clients via GET /Groups and GET /Groups/. Groups owned by a different client remain hidden (403 on direct read). For unmanaged groups, the members array is filtered on read to only the members owned by the requesting client.
identity/scim: externalId is now optional on POST /Users and is no longer required to be unique within a namespace. Multiple users may share the same externalId value.
identity/scim: permit adoption of unmanaged Vault groups only on PUT or PATCH SCIM requests.
identity: Include entity status and entity/alias timestamp details in entity list key_info responses.
jwt/oauth-resource-server: Profile resolution now walks the namespace ancestor chain, allowing a JWT whose OAuth Resource Server Configuration Profile is registered in a parent namespace to authenticate requests targeting resources in child namespaces.
kmip (enterprise): Add experimental API to execute KMIP requests.
license utilization reporting (enterprise): Add metrics for the number of issued PKI certificates.
license utilization reporting (enterprise): Utilization reports now include new license metadata fields issuer, edition, add_ons, license_start_time, license_expiration_time, and license_termination_time.
license utilization reporting: Added consumption billing metrics.
oauth-resource-server: Add support for fine-grained policy control options (parameter constraints) in Rich Authorization Requests (RAR), including allowed_parameters, denied_parameters, and required_parameters inside authorization_details.
oauth-resource-server: Add support for identity template expressions (e.g. {{identity.entity.id}}) in Rich Authorization Requests (RAR).
oauth-resource-server: Improved error body returned when permission is denied by ceiling policies to indicate that ceiling policies were what denied the request (CEILING_POLICY_DENIED).
pki: Reject obviously unsafe validation targets during ACME HTTP-01 and TLS-ALPN-01 challenge verification
policies: add warning about list comparison when using allowed_parameters or denied_parameters
product usage reporting (enterprise): Add vault.secure_hub_connected Census product usage metric to report whether a cluster is connected to the Secure Hub.
rotation: Ensure rotations for shared paths only execute on the Primary cluster's active node. Ensure rotations for local paths execute on the cluster-local active node.
scim: The SCIM Group PATCH handler now supports the path field in the form members[value eq "id"] on remove operations.
scim: User resources now include a read-only groups field listing the direct group memberships managed by the requesting SCIM client, per RFC 7643.
sdk/helper/keysutil: The lock manager's GetPolicy function now always returns a locked Policy, even when caching is enabled. The PolicyRequest struct has a new field to indicate whether the caller requires a write lock on the policy.
sdk/rotation: Prevent rotation attempts on read-only storage
sdk: Add NewTestDockerCluster support for running external plugins within the same container as the server. Also add support for those plugins to expose their own listeners, as KMIP does.
sdk: Add alias_metadata to tokenutil fields that auth method roles use.
sdk: Expand support for docker test cluster options like seals, kms libraries, and entropy augmentation. DockerClusterNode.UpdateConfig now takes a full set of cluster options instead of just node config.
sdk: add WIF and rotation helpers for checking if params were updated to allow the consumer to know when changes need to be persisted to storage
secret-sync (enterprise): Added telemetry counters for reconciliation loop operations, including the number of corrections detected, retry attempts, and operation outcomes (success or failure with internal/external cause labels).
secret-sync (enterprise): Added telemetry counters for sync/unsync operations with status breakdown by destination type, and exposed operation counters in the destinations list API response.
secret-sync: add parallelization support to sync and unsync operations for secret-key granularity associations
secrets import: Add support for allowed_ipv4_cidrs in source_aws and source_azure configuration blocks to allow connections to explicitly permitted private IPv4 ranges.
secrets-pki (enterprise): Add response data in a parsed format to the audit log for enrollment protocols.
secrets-sync (enterprise): Added support for a boolean force_delete flag (default: false). When set to true, this flag allows deletion of a destination even if its associations cannot be unsynced. This option should be used only as a last-resort deletion mechanism, as any secrets already synced to the external provider will remain orphaned and require manual cleanup.
secrets-sync (enterprise): Improved the user experience during mount lifecycle changes by triggering immediate unsyncing of external secrets when a secrets engine mount is deleted or disabled. By moving this logic from the background reconciliation loop to a direct callback, the system prevents perceived "leaks" and ensures external secret resources are cleaned up synchronously with the Vault unmount.
secrets-sync: Adds support for customer-controlled (CSP Managed) encryption in secrets sync flows for AWS destination.
secrets/aws: Added missing OpenAPI metadata for the aws secret engine endpoints
secrets/aws: Migrate AWS client from aws-sdk-go v1 to aws-sdk-go-v2.
secrets/database: Add root rotation support for Snowflake database secrets engines using key-pair credentials.
secrets/keymgmt (enterprise): Add support for multi-region AWS KMS keys.
secrets/kmip (enterprise): Obey configured best_effort_wal_wait_duration when forwarding kmip requests.
secrets/kv (enterprise): Support reading and recovering KVv2 secrets from a loaded snapshot, including in-place recover and copy-from-path within the same mount and namespace.
secrets/ldap: Users can now fully manage and tune the LDAP secrets engine. This includes the ability to view, edit, and configure the LDAP engine.
secrets/pki (enterprise): Allow SCEP to use an issuer that is backed by an RSA based PKCS#11 managed key
secrets/pki (enterprise): Return the POSTPKIOperation capability within SCEP GetCACaps endpoint for better legacy client support.
secrets/pki (enterprise): Validate entire chain in common criteria mode; add field to enable time checks on validation
secrets/pki (enterprise): When the commo
Original source
Oct 15, 2026
Date parsed from source:
Oct 15, 2026

First seen by Releasebot:
Oct 16, 2026
Bitwarden Android by Bitwarden

Password Manager 2026.10.0 (21955)

Bitwarden Android releases an update that opens newly saved vault items and adds Identity autofill support, while fixing passkey sign-in and clipboard clearing issues.
Overview

View your new item after saving it

Fixed passkey sign-in failing on some sites

Fixed Clear clipboard not clearing copied items

What's Changed

✨ Community Highlight

[PM-40488] fix: clear clipboard setting does not clear the clipboard on Android 13+ by @mvanhorn in #7169

Feature Development

[PM-41296] feat: Display Identities vault list when autofilling for an Identity by @aj-rosado in #7373

PM-39863: feat: Remove the Accepted Policies feature flag by @david-livefront in #7416

[PM-43011] feat: Land on newly created vault item after save by @aj-rosado in #7417

PM-37902: feat: handle key rotations by @david-livefront in #7420

PM-44047: feat: Hide create account button if environment is FedRamp by @david-livefront in #7421

🐛 Bug fixes

bug: fix FedRamp url by @david-livefront in #7426

fix: Pin release candidate to Source Fastlane track to prevent stale promotions by @AmyLGalles in #7352

[PM-44191] fix: Passkey allowCredentials and excludeCredentials never match by @quexten in #7431

[PM-44192] fix: Keep server cipher data after vault migration by @quexten in #7432

[PM-44193] fix: Detect v2 logins for first-time coach marks by @quexten in #7433

PM-44295: bug: Add new cipher types to bulk sharing api model by @david-livefront in #7439

⚙️ Maintenance

Crowdin Pull by @bw-ghapp[bot] in #7406

chore: Clean up vault unlock by @david-livefront in #7404

chore: Update PushManager to clarify Logout logic by @david-livefront in #7423

[QA-2565] Allow per-item testTags on overflow menu items by @Corbet-BW in #7424

[QA-2444] Add testTag to the Block Auto-fill dialog Save button by @Corbet-BW in #7425

Crowdin Pull by @bw-ghapp[bot] in #7429

chore: Minor cleanup of the BitwardenTextField and BitwardenPasswordField by @david-livefront in #7427

Fix for slack message parsing by @mpbw2 in #7411

chore: Add logger for the SDK by @david-livefront in #7403

Chore: Standardize all expanding headers to use BitwardenExpandingHeader by @david-livefront in #7440

📦 Dependency Updates

Update SDK to 3.0.0-8933-5c534361 by @bw-ghapp[bot] in #7401

Update SDK to 3.0.0-8946-8b9fa3e2 by @bw-ghapp[bot] in #7413

Update SDK to 3.0.0-9018-167d44ec by @bw-ghapp[bot] in #7418

[deps]: Update actions/setup-java action to v6 by @renovate[bot] in #7391

Update SDK to 4.0.0-9160-171b937c by @bw-ghapp[bot] in #7430

Full Changelog: v2026.9.1-bwpm...v2026.10.0-bwpm

Builds Source: https://github.com/bitwarden/android/actions/runs/37054920732
Original source
Oct 15, 2026
Date parsed from source:
Oct 15, 2026

First seen by Releasebot:
Oct 16, 2026
Bitwarden Android by Bitwarden

Authenticator 2026.10.0 (1995)

Bitwarden Android releases updates that improve identity autofill, open newly saved vault items, and support key rotations. The release also fixes clipboard clearing on Android 13 and newer, passkey matching, and other vault and FedRAMP issues.
Overview

Various under-the-hood bug fixes and improvements

What's Changed

✨ Community Highlight

[PM-40488] fix: clear clipboard setting does not clear the clipboard on Android 13+ by @mvanhorn in #7169

Feature Development

[PM-41296] feat: Display Identities vault list when autofilling for an Identity by @aj-rosado in #7373

PM-39863: feat: Remove the Accepted Policies feature flag by @david-livefront in #7416

[PM-43011] feat: Land on newly created vault item after save by @aj-rosado in #7417

PM-37902: feat: handle key rotations by @david-livefront in #7420

PM-44047: feat: Hide create account button if environment is FedRamp by @david-livefront in #7421

🐛 Bug fixes

bug: fix FedRamp url by @david-livefront in #7426

fix: Pin release candidate to Source Fastlane track to prevent stale promotions by @AmyLGalles in #7352

[PM-44191] fix: Passkey allowCredentials and excludeCredentials never match by @quexten in #7431

[PM-44192] fix: Keep server cipher data after vault migration by @quexten in #7432

[PM-44193] fix: Detect v2 logins for first-time coach marks by @quexten in #7433

PM-44295: bug: Add new cipher types to bulk sharing api model by @david-livefront in #7439

⚙️ Maintenance

Crowdin Pull by @bw-ghapp[bot] in #7406

chore: Clean up vault unlock by @david-livefront in #7404

chore: Update PushManager to clarify Logout logic by @david-livefront in #7423

[QA-2565] Allow per-item testTags on overflow menu items by @Corbet-BW in #7424

[QA-2444] Add testTag to the Block Auto-fill dialog Save button by @Corbet-BW in #7425

Crowdin Pull by @bw-ghapp[bot] in #7429

chore: Minor cleanup of the BitwardenTextField and BitwardenPasswordField by @david-livefront in #7427

Fix for slack message parsing by @mpbw2 in #7411

chore: Add logger for the SDK by @david-livefront in #7403

Chore: Standardize all expanding headers to use BitwardenExpandingHeader by @david-livefront in #7440

📦 Dependency Updates

Update SDK to 3.0.0-8933-5c534361 by @bw-ghapp[bot] in #7401

Update SDK to 3.0.0-8946-8b9fa3e2 by @bw-ghapp[bot] in #7413

Update SDK to 3.0.0-9018-167d44ec by @bw-ghapp[bot] in #7418

[deps]: Update actions/setup-java action to v6 by @renovate[bot] in #7391

Update SDK to 4.0.0-9160-171b937c by @bw-ghapp[bot] in #7430

Full Changelog: v2026.9.1-bwa...v2026.10.0-bwa

Builds Source: https://github.com/bitwarden/android/actions/runs/37054924511
Original source
Oct 15, 2026
Date parsed from source:
Oct 15, 2026

First seen by Releasebot:
Oct 15, 2026
Infisical

v0.166.8

Infisical releases updates including webhook authentication and custom headers, alerts for audit log streams dropping logs, Portainer secret sync support, and improvements to secret sharing, authentication, and the user interface.
What's Changed

feat: add semantic Secrets Overview telemetry by @andrewhuhh in #8636

feat(billing): add optional cancellation comment to the Billing V2 cancel reason event by @andrewhuhh in #8634

docs(secret-scanning): overhaul section by @adkah in #8650

feat(alerts): add authentication and custom headers to webhook channels by @Thiago-AS in #8582

feat(audit-log-stream): alert when a stream starts dropping logs by @lobocv in #8526

feat: added test for saml in api e2e by @akhilmhdh in #8638

improvement(cert-manager): migrate CaInstallCertModal to v3 Dialog by @andrewhuhh in #8592

fix: remove mention of "project" from secret scanning by @mathnogueira in #8568

improvement(secret-manager): migrate native integration creation pages to V3 (S11) by @andrewhuhh in #8614

improvement(secret-manager): migrate native integration creation pages to V3 (S12) by @andrewhuhh in #8617

improvement(integrations): port native provider creation pages to V3 (S13) by @andrewhuhh in #8616

improvement(integrations): port native provider creation pages to V3 (S14) by @andrewhuhh in #8618

fix(auth): allow retry after MFA organization selection fails by @andrewhuhh in #8620

improvement(ui): support Sheet and in-place Combobox creation by @andrewhuhh in #8621

fix(cert-manager): anchor signing configuration sheet footers by @andrewhuhh in #8623

fix(ui): compose machine identity dialog body and footer by @andrewhuhh in #8624

fix(pam): anchor detail sheet headers and action footers by @andrewhuhh in #8625

fix(ui): use canonical Sheet footers in reusable wizard forms by @andrewhuhh in #8626

fix(cert-manager): use canonical Sheet footers by @andrewhuhh in #8627

chore(ui): delete orphan notice family and dead admin adapters by @andrewhuhh in #8630

improvement(ui): compose KMS signing dialogs with V3 shells by @andrewhuhh in #8646

improvement(cert-manager): migrate clear PKI overlays to v3 by @andrewhuhh in #8647

improvement(secret-sharing): masked share value, name prefill, and constraint count by @andrewhuhh in #8633

chore(ui): remove unused V2 SecretPathInput source by @andrewhuhh in #8656

improvement(auth): use V3 alert for passkey failures by @andrewhuhh in #8655

fix(ui): reserve toast close-button space and default bulk bar to icon clear by @andrewhuhh in #8661

improvement(proxied-services): migrate surface picker to Combobox by @andrewhuhh in #8659

fix(cron): dedup fires on a per-job key and skip a new job's first due fire by @lobocv in #8587

fix(identity-ua): compare client secret usage counts as numbers by @lobocv in #8644

fix: resovled test failing due to ci contraint by @akhilmhdh in #8667

feat(query): return all tags for evaluation by @adilsitos in #8576

fix(ui): match quick-add secret key input weight to secret rows by @andrewhuhh in #8670

fix(ui): secret reference selector scrolling, search, and dismissal by @andrewhuhh in #8662

feat(secret-sync-app-connection): support for portainer by @zenato in #7670

New Contributors

@zenato made their first contribution in #7670

Full Changelog: v0.166.7...v0.166.8
Original source
Oct 15, 2026
Date parsed from source:
Oct 15, 2026

First seen by Releasebot:
Oct 14, 2026

Modified by Releasebot:
Oct 16, 2026
Bitwarden Clients by Bitwarden

Browser v2026.10.0

Bitwarden Clients releases updates that add CLI desktop biometric unlock support, improve password and passphrase imports, and refine organization and vault experiences. The update also fixes bugs across browser, desktop, and web clients.
What's Changed

💙 Community Highlight

[PM-42038] Add desktop biometric unlock support to the CLI by @nurfed1 in #22448

[PM-43951] Add rotation icons (calendar, pause-circle, resume) by @reneelund08 in #23346

[PM-42997] Clear policiesNew state when the sync response contains no policies by @tom27052006 in #22929

[PM-42977] Added a length to the passphrase generated by @Jbziscool in #22906

[PM-44145] [PM-24830] Add regression test for Chrome CSV note import by @MrSerWin in #23506

[PM-44109] Fix: LastPass direct import corrupts non-ASCII characters (bullets, smart quotes) by @jaykaplon in #23481

[PM-44235] Group 1Password import sources and add the direct import dialogs by @detunized in #23559

Feature Development

[PM-42846] Wire up the invite link callout dialog by @BTreston in #23217

[PM-43141] Introduce new import source component by @harr1424 in #23031

Updated extension icon size by @trmartin4 in #23342

[PM-38885] feat: Show sales rep contact message on sales-assisted trial banner by @cyprain-okeke in #23036

[PM-40417] feat: Source the Premium to organization upgrade cart from the invoice preview by @cyprain-okeke in #23048

[PM-44001] Add pm-43231-access-intelligence-performance-at-scale feature flag by @Banrion in #23366

[PM-43143] Admin Console owned importer changes by @harr1424 in #23198

feat(dev-ex): Add a debug launch script for the CLI by @quexten in #23273

Autotype GA: port MVP type input and add execute_autotype by @neuronull in #23335

[PM-43679] Adjust min-width so that long vendor names are truncated by @harr1424 in #23352

[PM-43142] Vault owned importer changes by @harr1424 in #23197

Updated icons with sized versions. by @trmartin4 in #23425

[PM-42836] feat: Update the sponsored Families redemption page for VFO1 by @cyprain-okeke in #23304

[PM-39106] Remove pm-34423-staged-status feature flag by @sven-bitwarden in #23422

[PM-43756] Terminology/description change quickly for autofill policy by @JaredScar in #23363

[PM-40421] feat: Preview-driven premium subscription page with applied-balance cart by @amorask-bitwarden in #23390

[PM-43684] Show Decryption failures and dialog in VFO1 UX on Web by @shane-melton in #23298

[PAM-242] Mount the PAM nav slot in the individual user layout by @Hinton in #23483

[PM-39411] feat: Wire flight recorder into clients behind flag by @dani-garcia in #23448

feat: Toast automation biometric requests and results by @quexten in #23482

[CL-1316] feat: Make the vfo1 side nav logo header sticky on scroll by @BryanCunningham in #23339

[PM-44120] Isolate Beta desktop keychain entries from stable by @trmartin4 in #23485

[PM-41920] Add WiFi network and unknown item type handling to Proton Pass by @mcamirault in #23156

[CL-1327] Remove rounded desktop corner from non-Mac OS by @vleague2 in #23498

[PM-40550][PM-40553] Remove batch bar feature flags by @nick-livefront in #23456

[PM-42229] Update accordion height to auto in shared folder card grid by @jengstrom-bw in #23561

[PM-31298][PM-31299] Remove webauthn related origins feature flag by @djsmith85 in #23229

[PM-43938] Call new organization collections endpoint behind performance flag by @Banrion in #23417

[PM-44425] Add SDK-backed organization login cipher fetch to CipherService by @shane-melton in #23610

[PM-43785] Login only organization cipher fetch for Access Intelligence by @Banrion in #23567

❗ Breaking Changes

[PM-42019] SDK breaking change fix: pass collection type arg to SDK importer by @harr1424 in #23306

PM-41073: Consume breaking changes from SDK making all children of CipherView decrypted by @nikwithak in #22245

🐛 Bug fixes

[PM-42038] Gate CLI desktop biometric unlock behind a flag by @quexten in #23333

[PM-42474] fix: validate initiator in auto-submit redirect handler by @bensbits91 in #23078

[PM-43844] Remove extra space between Import and Add buttons in table header by @jengstrom-bw in #23341

[PM-43945] Adds trimming/sanitization to frontend of sending invites to emails v… by @JaredScar in #23300

[PM-43846] Prepopulate import dialog by @nick-livefront in #23345

fix: track vault items table rows by cipher id to prevent icon flicker by @nick-livefront in #23256

[PM-43777] Password Manager product switcher focus highlight gets stuck on by @jengstrom-bw in #23347

[PM-43971] Hide callout if link is already configured by @BTreston in #23367

[PM-43844] Move tw-hidden to coachmark component by @jengstrom-bw in #23391

[PM-43728] VFO1 Item Id query param handling by @shane-melton in #23302

[PM-43970] Work around for saving domains via the tour by @BTreston in #23388

[PM-43841] Update URL terminology by @BTreston in #23364

[PM-44114] Revert change detection by @BTreston in #23484

[PM-44084] Utilizes the vfo name for success toast when the vfo1 foundation flag on by @JaredScar in #23460

[PM-44040] fix: Remove period and em dash in My folders empty state by @gbubemismith in #23470

[PM-44038] Move Add plan next to Subscription in settings nav by @jaasen-livefront in #23471

[PM-44072] Drop the startup sync from desktop init by @quexten in #23447

[PM-44071] Dedupe key state emissions by @quexten in #23446

[PM-43947] Allow share when org settings allow owners/admins to manag… by @mcamirault in #23349

[PM-44070] Emit feature flags only when their value changes by @quexten in #23445

PM-39391 resolved flickering when toggling send rows by @bmbitwarden in #23328

Auth/PM-40943 - Extension - Duo 2FA - Improve DuoResult Validation by @JaredSnider-Bitwarden in #23224

PM-43842 changed folder label on import by @bmbitwarden in #23435

[CL-1342] Independent Browser Filters by @nick-livefront in #23494

[PM-42019] Fix import folder/collection count logic by @harr1424 in #23266

PM-44046: bugfix: Decryption error is returned when the user leaves org by @nikwithak in #23496

[PM-43358] fix: Fix account switcher badge icon spacing by @nick-livefront in #23578

[PM-44197] Decrypt refreshed ciphers via CipherService by @quexten in #23542

[PM-44222] Keep item URL params while the reprompt is open by @shane-melton in #23586

[PM-44269] use native messaging for Safari biometrics when SDK IPC is on by @mzieniukbw in #23566

[PM-44101] fix: Add truncate option to bitLink and truncate shared folder names by @nick-livefront in #23577

[PM-41263][PM-41035] Add userId on auto-confirm method chain by @trmartin4 in #23428

[PM-43786] perf(dirt): speed up exposed-password check at scale by @Banrion in #22853

[PM-44516] Temporarily hide item history on item Sends (#23730) by @mcamirault in #23762

[PM-44168] Render the popup loading spinner only while loading (#23528) by @willmartian in #23862

⚙️ Maintenance

feat(desktop): Connect debug browser and desktop over native messaging by @quexten in #22914

[PM-42469] communicate sender only through trusted channels by @audreyality in #23249

[PM-43877] Changes UserStatusPipe to standalone component by @JaredScar in #23301

[PM-43872] Remove ElectronCachedStorage flag by @dani-garcia in #23299

[PM-43878] Fixes tech debt and moves away from modules into standalone usage by @JaredScar in #23303

[CL-1354] Add contributing docs to libs/components by @willmartian in #23365

chore(crypto): drop TS key connector; the master key and master-key-wrapped-user-key state by @quexten in #23207

[PM-43919] Remove unused KeyApiService by @trmartin4 in #23376

[PM-43879] Migrate GroupNameBadgeComponent to standalone and move off of module by @JaredScar in #23305

refactor: Remove unused KeyConnectorUserKeyResponse by @quexten in #23329

fillAssistRules url swap by @alex8bitw in #23209

[PM-43929] Exclude core-js polyfills from Chrome extension build by @coroiu in #23433

[PM-42900] Ts-strict refactor by @BTreston in #23219

[PM-34691] Remove copy and quick launch actions feature flag by @jaasen-livefront in #23416

Bump client version(s) by @github-actions[bot] in #23461

Bump client version(s) by @github-actions[bot] in #23465

[PM-25909] Commercial desktop builds by @dereknance in #18094

[PM-43895] migrate domain verification components to standalone by @BTreston in #23457

[PM-43894] Migrate providers list componet to standalone by @BTreston in #23459

[PM-43884] Standalone migrations for ReportsHomeComponent by @JaredScar in #23493

QA-2489/add-data-testid-bit-select-value by @ddanielyan in #23530

Autosync Crowdin Translations for desktop by @bw-ghapp[bot] in #23474

docs: Deprecate format-internal fields on Cipher by @quexten in #23549

[PM-42124] Move sass and sass-loader to be owned by UIF by @djsmith85 in #22488

Autosync Crowdin Translations for web by @bw-ghapp[bot] in #23473

[PM-43880] VaultFilterComponent to standalone migration by @JaredScar in #23487

[PM-43883] Make bulk components standalone by @JaredScar in #23492

[PM-44130] Access Intelligence: Remove Add-Padding header for HIBP requests by @lastbestdev in #23500

[BRE-2283] Use the supplied release notes verbatim for the Mac App Store by @pixman20 in #23537

[BRE-2283] Remove the Mac App Store Fastfile now that deploy owns it by @pixman20 in #23557

[PM-43942] Access Intelligence: Use stored icon URIs for loading application icons by @lastbestdev in #23421

[PM-44196] Remove dead encryptObjProperty from CipherService by @quexten in #23541

[PM-38193] Remove pm-29968-fill-after-save feature flag by @shane-melton in #23427

Autosync Crowdin Translations for browser by @bw-ghapp[bot] in #23472

Platform/PM-44117 - SDK client settings - Set device identifier by @JaredSnider-Bitwarden in #23539

Autosync Crowdin Translations for desktop by @bw-ghapp[bot] in #23574

Autosync Crowdin Translations for web by @bw-ghapp[bot] in #23576

Autosync Crowdin Translations for browser by @bw-ghapp[bot] in #23575

[PM-37683] Remove pm-32016-remove-at-risk-callout feature flag by @shane-melton in #23426

[PM-31967] Remove pm-31039-item-action-in-extension feature flag by @shane-melton in #23429

[PM-28191] - remove pm-28191-cipher-admin-ops-to-sdk feature flag by @jaasen-livefront in #23564

Mute flaky filter menu story for now by @vleague2 in #23595

[PM-28190] - remove pm-28190-cipher-sharing-ops-to-sdk from clients feature flag by @jaasen-livefront in #23563

Tools/PM-44409 - CLI - Send Receive command - Add Device Identifier Header to send access token request by @JaredSnider-Bitwarden in #23607

Autosync Crowdin Translations for desktop by @bw-ghapp[bot] in #23614

Autosync Crowdin Translations for browser by @bw-ghapp[bot] in #23615

Autosync Crowdin Translations for web by @bw-ghapp[bot] in #23616

ci: Sign Windows Stable Appx by @iinuwa in #23600

Sign Electron Framework files in parallel on macOS by @iinuwa in #23580

[PM-41279] refactor: Remove pm-40435-quick-copy-icon-setting feature flag by @jaasen-livefront in #23613

[PM-39412] refactor: Delegate renderer log write to super.write by @dani-garcia in #23495

Bump client version(s) by @github-actions[bot] in #23647

[BRE-2323] Use correct Safari build for each macOS build by @vgrassia in #23697

[BRE-2234] Cherry-pick macOS provisioning profile and Safari artifact fixes to rc by @pixman20 in #23768

[PM-44917] Cherry pick browser health OSS move by @ttalty in #23845

📦 Dependency Updates

[PM-40862][PM-40850] deps: Update Angular build toolchain and Storybook to clear advisories by @BryanCunningham in #23294

[deps] Update rustls to 0.23.45 (RUSTSEC-2026-0285) by @coroiu in #23375

Update sdk-internal to 0.2.0-main.1046 by @bw-ghapp[bot] in #23370

[deps] Platform: Update browserslist to v4.28.7 [SECURITY] by @renovate[bot] in #23449

[deps]: Update actions/setup-node action to v7 by @renovate[bot] in #23453

[deps] Vault: Update multer to v2.3.0 [SECURITY] by @renovate[bot] in #23451

[deps] Platform: Roll back browserslist transitives to unblock npm ci by @mandreko-bitwarden in #23468

[deps] Platform: Update Rust crate dirs to v7 by @renovate[bot] in #23516

[deps]: Update dtolnay/rust-toolchain digest to 6bed076 by @renovate[bot] in #23509

[deps] Platform: Update electron to v43.5.0 [SECURITY] by @renovate[bot] in #23560

[deps] Platform: Pin electron's nested @types/node to 24.13.6 by @mandreko-bitwarden in #23570

Update sdk-internal to 0.2.0-main.1066 by @bw-ghapp[bot] in #23430

Update sdk-internal to 0.2.0-main.1068 by @bw-ghapp[bot] in #23590

Update sdk-internal to 0.2.0-main.1073 by @bw-ghapp[bot] in #23599

Update sdk-internal to 0.2.0-main.1074 by @bw-ghapp[bot] in #23612

Update sdk-internal to 0.2.0-main.1075 by @bw-ghapp[bot] in #23621

🎨 Other

[AI-94] llm: Let the SDK evaluation agent judge the baseline type check by @SaintPatrck in #23373

New Contributors

@tom27052006 made their first contribution in #22929

@Jbziscool made their first contribution in #22906

@MrSerWin made their first contribution in #23506

@ddanielyan made their first contribution in #23530

@jaykaplon made their first contribution in #23481

Full Changelog: browser-v2026.9.3...browser-v2026.10.0
Original source
October 2026
No date parsed from source.

First seen by Releasebot:
Oct 15, 2026
Bitwarden

2026.10.0

Bitwarden releases temporary vault-item sharing via controlled links, browser-extension vault health reports for identifying risky passwords, and a new self-hosted setting to configure access-token lifetime.
(The listed release number is for the Bitwarden Server. Other version numbers released in this cycle include Web 2026.10.0, Browser Extension 2026.10.0, Desktop 2026.10.0, Mobile 2026.10.0, and CLI 2026.10.0)

Password Manager

Share via link: Premium users and members of paid organizations can now share a temporary copy of a vault items with specific people using a link, with rules that control who can open it and for how long. Learn more about sharing vault items.

Vault health reports: You can now run vault health reports in your browser extension to identify exposed, weak, and reused passwords. Premium and Families subscriptions can see which specific logins are at-risk, and those with a Free subscription can see how many passwords are flagged.

Self-host

New environment variable: You can now set the lifetime duration of access tokens using an environment variable.

Original source
Oct 14, 2026
Date parsed from source:
Oct 14, 2026

First seen by Releasebot:
Oct 14, 2026
Keeper

Admin Console 17.11.3

Keeper releases Admin Console 17.11.3 with Node Isolation controls, passkey authentication policies, improved SCIM team visibility, and Endpoint Privilege Manager updates. The release also fixes Government Cloud dashboard and compliance report issues, along with other usability bugs.
Overview

Admin Console 17.11.3 introduces user interface support for Node Isolation, new Role Enforcement Policies for Passkey Authentication controls, and Endpoint Privilege Manager enhancements, alongside improved SCIM team visibility and critical Government Cloud bug fixes.

New Features

Node Isolation

We've added the ability to enable or disable Node Isolation directly from the Admin Console under Admin > Node Options, allowing you to restrict visibility between sibling nodes without requiring commands to be run through the Keeper Commander CLI.

Passkey Authentication Role Enforcement Policies

Added Enforcement Policies to control whether Passkey Authentication is enabled and specify which authentication methods users can use, including security keys and biometrics.

Improvements & Bug Fixes

EM-9118 - Added a Keeper 101 Video on the "Getting Started" page for KeeperDB.

EM-9159 - Added a search filter to Nodes for easier navigation.

EM-9082 - Added an "Invited" tab to Teams to display SCIM-provisioned users who have not yet accepted their invitation.

EM-8795 - Added an error message when creating a Role or Team name that goes over the maximum amount of characters.

EM-7773 - Added the edit option after verifying and saving Email Auto-Provisioning.

EM-9146 - Added tooltips to all the KeeperPAM Enforcement Policies.

EM-9104 - Improved the User Status Report download filename to include the report name and date.

EM-8761 - Fixed an issue where newly created Roles were not automatically selected by default upon creation.

EM-8680 - Fixed an issue with the Government Cloud environments showing the Risk Management Dashboard scores not tabulating for certain users.

EM-8327 - Resolved an issue where the BreachWatch section is not appearing on the dashboard for Managed Companies.

EM-8472 - Fixed an issue with Endpoint Privilege Manager where custom policy types were not sorted correctly.

EM-8970 - Fixed an issue where the "Stay Logged In" toggle was not working correctly after a page reload.

EM-9226 - Fixed an issue where a Managed Service Provider could not download a Compliance Report for a Managed Company.

EM-9191 - Fixed the Endpoint Privilege Manager Deployment token domain for Government Cloud environments.

Original source
Oct 14, 2026
Date parsed from source:
Oct 14, 2026

First seen by Releasebot:
Oct 14, 2026
Keeper

Vault Release 18.6.5

Keeper fixes a Nested Shared Folders bug so revoking parent-folder access no longer removes a user’s independent access to child folders.

Bug Fixes

VAUL-9567, KDE-2317: Fixed an issue with Nested Shared Folders where revoking a user’s access to a parent folder would also remove their independently granted access to child folders.

Web Vault Update Instructions

To ensure you're using the latest Web Vault, simply reload the vault login page (or Shift+Ctrl/Cmd+R to force refresh)

Desktop Update Instructions

If you installed Keeper Desktop directly from the Keeper website, download the latest version from:

If you installed Keeper Desktop from the Mac App Store or Microsoft Store, visit the store to perform the update.
Original source

Password and Secrets Management Release Notes

Products (16)

Latest Password and Secrets Management Updates

Password Manager 2026.10.0 (3551)

Overview

What's Changed

Feature Development

🐛 Bug fixes

⚙️ Maintenance

📦 Dependency Updates

🎨 Other

New Contributors

Authenticator 2026.10.0 (898)

Overview

What's Changed

Feature Development

🐛 Bug fixes

⚙️ Maintenance

📦 Dependency Updates

🎨 Other

New Contributors

v2.2.0

Password Manager 2026.10.0 (21955)

Overview

What's Changed

✨ Community Highlight

Feature Development

🐛 Bug fixes

⚙️ Maintenance

📦 Dependency Updates

Authenticator 2026.10.0 (1995)

Overview

What's Changed

✨ Community Highlight

Feature Development

🐛 Bug fixes

⚙️ Maintenance

📦 Dependency Updates

v0.166.8

What's Changed

New Contributors

Browser v2026.10.0

What's Changed

💙 Community Highlight

Feature Development

❗ Breaking Changes

🐛 Bug fixes

⚙️ Maintenance

📦 Dependency Updates

🎨 Other

New Contributors

2026.10.0

Password Manager

Self-host

Admin Console 17.11.3

Overview

New Features

Node Isolation

Passkey Authentication Role Enforcement Policies

Improvements & Bug Fixes

Vault Release 18.6.5

Bug Fixes

Web Vault Update Instructions

Desktop Update Instructions