The community behind OpenBao has released version 2.6 of the open-source secrets-management system. Published on 14 July 2026, the HashiCorp Vault fork ships two changes aimed mainly at multi-tenant operations and automation: a per-namespace seal and a workflow engine for communication between plugins.
Sealing now works per namespace
Until now the seal state applied to an entire OpenBao instance. With 2.6 you can configure a dedicated Shamir seal and separate key material when a namespace is created. Individual tenants can seal their own space – cutting off access, if necessary even against the instance operator – without disturbing other namespaces. The seal status is synchronised across all nodes, which simplifies management in distributed clusters. For self-hosters who separate several projects or customers on a single instance, that is a tangible hardening step.
Workflows for cross-plugin operations
Under the new sys/workflows endpoints, operators define multi-step sequences that bundle several requests and communicate across plugin boundaries; users then execute those workflows. This enables organisation-specific governance rules directly inside OpenBao, or simplified facades over otherwise scattered functionality. Workflows can optionally be triggered without authentication – but the requests they dispatch still require valid credentials.
What it means for admins
OpenBao emerged in 2023 in response to HashiCorp switching Vault from the open MPL 2.0 to the more restrictive Business Source License. Since December 2023 the project has been developed under the Linux Foundation and remains API-compatible with Vault, which keeps migration comparatively painless. Version 2.6 counts contributions from 42 first-time contributors, a sign of a growing community. Anyone looking for a Vault alternative without licensing headaches now gets two persuasive arguments in the form of the new isolation and automation features.
Sources: OpenBao 2.6.x release notes, the GitHub release v2.6.0, and the OpenSSF announcement.
