OpenBao has released version 2.7, introducing post-quantum cryptographic algorithms, external hardware security module support, and read scaling for PostgreSQL-backed deployments, according to a report published by InfoQ. The update represents a significant evolution for the community-driven fork of HashiCorp Vault, which emerged after HashiCorp shifted Vault's licensing from the Mozilla Public License to the Business Source License in 2023. The project, now governed under the Linux Foundation's Open Source Security Foundation and distributed under MPL 2.0, aims to deliver a secrets manager under open governance rather than single-vendor control.
The new release extends horizontal scaling capabilities to PostgreSQL backends, allowing standby OpenBao instances using that backend to handle read operations similarly to Raft-based deployments. External key support enables the PKI and Transit secrets engines to utilize key material stored in an HSM or KMS instead of inside OpenBao itself, delivered through third-party plugins. Post-quantum additions include ML-DSA and ML-KEM algorithms for TLS listeners, certificate authentication, PKI and Transit, giving operators a path to test hybrid and post-quantum configurations. Control groups introduce an approval workflow requiring a second party to review access to specified paths for high-risk operations where a single authenticated identity shouldn't act alone. The release also discontinues the separate HSM distribution and moves vendor-specific auto-unseal mechanisms for Alibaba Cloud, AWS, Azure, Google Cloud and Oracle Cloud to plugins, while Kerberos, LDAP and RADIUS authentication shift into the openbao-plugins repository.
Alex Scheel announced the release for the OpenBao project, writing "We are thrilled to announce the availability of OpenBao v2.7, adding PostgreSQL horizontal scalability, External HSM and KMS-Backed Keys support, and Post-Quantum Cryptography!" He noted that the release arrived after a shorter development cycle than the previous one and included "many substantial features and several major security patches". Luca Berton, who interviewed Scheel at Open Source Summit Europe, highlighted that external keys allow operators to run PKI root backed by an HSM with key material comparable to Vault Enterprise managed keys. He also emphasized the importance of post-quantum support before government transitions expected around 2030, citing the risk that encrypted traffic recorded today could be decrypted in the future.
The fork followed the wider pattern that produced OpenTofu from Terraform and Valkey from Redis, driven by both ideological and commercial motivations. Some users objected to losing an OSI-approved license and to the possibility that a vendor could alter terms governing infrastructure they had already adopted. Others recognized a practical opportunity: Vault had placed capabilities such as namespaces, HSM integration and advanced scalability behind enterprise licenses, while an open fork could make comparable functionality available without those restrictions. Since the fork, OpenBao has added namespaces for multi-tenant isolation, plugin-based auto-unseal integrations, and read scalability for its integrated Raft storage backend. Commercial support is also emerging: ControlPlane launched ControlPlane Enterprise for OpenBao in March, offering security hardening, supply-chain assurance, rapid CVE remediation, optional FIPS 140-3 compliance support and 24/7 technical support, illustrating how an open-source project can remain freely licensed while vendors compete on operational assurance.
OpenBao version 2.8 is expected to focus more on security and stability, with likely improvements to authentication. For teams evaluating a migration, the immediate questions center on operational maturity: plugin lifecycle management, PostgreSQL high-availability configuration, post-quantum client compatibility and the availability of support for production incidents. The report suggests that OpenBao's progress indicates the fork is becoming a credible alternative rather than merely a protest project. Organizations that need enterprise-style operational commitments but prefer OpenBao's license and governance model now have a supported path forward, while the addition of post-quantum cryptography positions early adopters to begin testing configurations ahead of anticipated regulatory transitions. The competitive landscape for secrets management infrastructure now includes viable open-governance options that challenge the premise that advanced capabilities require proprietary licensing models.