OpenBao 2.7: post-quantum and HSM keys

Why this conversation

Secrets management sits under almost everything a platform team runs, and OpenBao is the community fork of HashiCorp Vault that many of those teams now look at. At Open Source Summit Europe in Prague, the host caught up with Alex Scheel, Head of OpenBao Development at Control Plane, near the OpenSSF area. The two had already met at PlatformCon in London. This is a short conversation, about two and a half minutes, on what the latest release changed. The rest of the week is in Open Source Summit Europe 2026: who we met.

What OpenBao 2.7 shipped

Alex has heard from a number of customers and community members running OpenBao, and the release he points to is OpenBao 2.7, out at the end of September. It brought horizontal scalability on top of Postgres. It brought external key support, so a PKI root can now be backed by an HSM, with key material handled in a way similar to Vault Enterprise’s managed keys.

And, as he put it, “not to bury the lede”: 2.7 also ships post-quantum support. He acknowledges that the term has become a buzzword. The need is concrete, though. Governments are moving to new cryptographic algorithms around 2030, and people need signature algorithms and key exchange mechanisms that stay resistant for the next 30, 40 or 50 years.

What comes next

The roadmap has two main lines. The first is support for additional authorization mechanisms, built either as an external plugin or into OpenBao itself, as a replacement for Sentinel support. The second is moving from read scalability to write scalability, which will require a lot of changes to the core architecture. Beyond features, he wants to keep building trust in the platform the project has already built.

Getting involved

The starting point is the OpenBao project on GitHub, and the project has a Zulip channel. Users can also post about it on LinkedIn. Alex’s simplest request: tell the team that you are using it.