HashiCorp Vault

HashiCorp Vault: frequently asked questions

Is HashiCorp Vault still open source?

No, not by the OSI definition. Vault moved from MPL 2.0 to the Business Source License 1.1 on 10 August 2023, first shipping under it in version 1.15.0. BUSL 1.1 is source-available: you can read, modify, and run the code in production, but you may not offer it to third parties on a hosted or embedded basis in competition with IBM's paid versions. That field-of-use restriction is why BUSL is not an OSI-approved license, and why the OpenBao fork exists. HashiCorp APIs, SDKs, and most other libraries remain MPL 2.0.

When does Vault's license convert back to open source?

Each release converts individually, four years after that release is published, at which point it becomes MPL 2.0. This is a rolling per-release Change Date, not a single calendar date, and most secondary sources get it wrong. Vault 1.15.0, published September 2023, converts around September 2027. Vault 2.1.1, published September 2026, does not convert until September 2030. So Vault as a shipping product never becomes open source under this arrangement; only individual four-year-old releases do.

How much does HashiCorp Vault cost?

Vault Community is free to self-host. The managed service, now listed by IBM as IBM Vault Dedicated (formerly HCP Vault Dedicated), has published pay-as-you-go rates: 72.92 dollars per client per month on Essentials and Standard, plus a cluster charge per hour, from 0.61644 dollars for a Development Extra Small cluster to 1.57799 (Essentials) or 1.84299 (Standard) for Small, and up to 9.40599 for a Standard Large cluster. Prices exclude tax and may vary by country. Self-managed Vault Enterprise has no list price and is quoted (checked 2026-11-05).

Who owns HashiCorp Vault in 2026?

IBM. It completed the HashiCorp acquisition on 27 February 2025 at 6.4 billion dollars enterprise value, 35 dollars per share, and moved business operations to IBM on 1 September 2025. The product still ships and is documented as HashiCorp Vault, and Vault Enterprise 2.0 kept the HashiCorp name, but IBM sells the SKUs under IBM names: IBM Vault Self-Managed (IBM product ID 5900-BJF, shared with Boundary) and IBM Vault Dedicated for the managed service. Billing, invoicing and licence compliance go through IBM, and support follows IBM Support Cycle-2.

Is HashiCorp Vault affected by VaultFault and the 2026 security bulletins?

Patched releases fix all of them. VaultFault (HCSEC-2025-22, disclosed 6 August 2025 at Black Hat USA by Cyata) included CVE-2025-6000, the first public Vault remote code execution at CVSS 9.1, and CVE-2025-5999, a policy-name normalization bug that let a token reach root; fixes landed in Vault 1.20.2 and matching Enterprise releases. In April 2026 HCSEC-2026-07 (CVE-2026-4525) disclosed that Vault could forward a client's Vault token to auth plugin backends when the Authorization header was passed through; it is fixed in 2.0.0 and Enterprise 1.21.5, 1.20.10 and 1.19.16.

Is HCP Vault Secrets still available?

No. HCP Vault Secrets reached end of sale on 30 June 2025 and end of life on 1 July 2026, so it is gone as of this review. The documented migration path is HCP Vault Dedicated or self-hosted Vault Community. Any comparison or review still listing HCP Vault Secrets as a current tier is out of date.

What is OpenBao and is it a real alternative to Vault?

OpenBao is the fork of Vault created after the BUSL relicensing, governed under the Linux Foundation and, since June 2025, OpenSSF. It is materially mature: v2.6.2 shipped in August 2026, and the v2.7 beta in September 2026 added external key support for PKI and Transit via KMS plugins plus ML-DSA post-quantum signatures and pure post-quantum TLS. The v2.6 cycle drew 42 first-time contributors. Notably, OpenBao is now diverging from Vault rather than merely tracking it, shipping post-quantum cryptography and namespace sealing ahead of upstream. For teams whose objection is the license rather than the capability, it is a credible destination.

Is Vault FIPS 140-3 validated?

Not exactly, and the distinction matters. Vault Enterprise ships FIPS builds using BoringCrypto, which holds NIST CMVP certificate 4735, with binaries carrying the +ent.fips1403 and +ent.hsm.fips1403 suffixes. FIPS 140-3 Level 1 compliance was added in Vault Enterprise 1.21, with support stated from 1.19.4. However, HashiCorp's own documentation states that the 140-3 certificate belongs to the BoringCrypto module rather than to Vault, and that Vault's own full 140-3 evaluation is pending. Accurate phrasing: Vault Enterprise ships validated cryptography; Vault as a product is not itself 140-3 validated.

What are the best HashiCorp Vault alternatives?

OpenBao if the BUSL license is the objection and you want a drop-in fork. AWS Secrets Manager or Azure Key Vault if you are single-cloud and want the native option with no operational burden. Akeyless, Doppler, or Infisical if you want managed secrets with a lower operational floor than Vault. CyberArk Conjur (now Idira Secrets Manager) if you need secrets management inside an established enterprise privileged access programme. Vault remains the broadest option, with 26 secrets engines, 21 auth methods, and 23 storage backends, but breadth is exactly what you pay for in operational complexity.