CyberVault KMS Release Notes

1.1.1 (2026-10-27)

Maintenance release of CyberVault KMS.

KMIP:

A KMIP client's credentials can be downloaded in the shape the receiving client expects: separate PEM files, a keystore with a matching truststore, or a single PKCS#12 file.
Every one of those downloads now also contains the KMIP server certificate the client has to trust.
Adding or removing a KMIP client no longer asks for a server restart.
The KMIP server keystore can be regenerated from a certificate profile, and the certificate is shown for review before it is issued.
The connectivity test lists every target in a table and ends on a clear verdict.
The PEM download also contains the certificate and key in one file, which is what MongoDB expects.
Generating the key on the HSM is now the default when you add a KMIP client.
The bundled KMIP Server 1.1.1 changes some defaults, so read the KMIP release notes before you upgrade.

Keys & Certificates:

Certificate operations and certificate profiles now work with the base REST_API license, they no longer require KEY_MANAGEMENT_SYSTEM.
Every certificate the Key Manager issues now takes its key usages from a certificate profile, including the KMIP and TSB client certificates.
The review step before issuance says how the certificate will differ from the profile it was built from.

Administration:

Managing approvers no longer requires the KEY_MANAGEMENT_SYSTEM license, only the SKA engine on the HSM.
Errors are now shown as plain sentences instead of the raw text the Key Manager received.
When a partition access token has expired, or the REST API cannot reach an HSM, the affected actions are greyed out and a banner links to the credentials that fix it.
Registering an HSM Partition asks for the address of the REST API, so an on-premise TSB is registered the same way as one on the KMS stack.
A TSB access token is checked against the TSB before it is saved.
The AI Assistant has its own settings page under Administration.
Anthropic, OpenAI and a local model each keep their own API key, so switching provider no longer means pasting a key again.

Dashboard:

The dashboard now works on a phone and a tablet, so an on-call check no longer needs a desktop browser.
Lists become cards on a small screen, dialogs open from the bottom, and the navigation moves into a drawer.
Buttons and links are big enough to tap, and controls that used to appear only on mouse-over are now always visible on a touch screen.
Enter confirms a dialog and Escape closes it, including the KMIP and TSB wizards.
A table's columns are chosen from a dropdown on the table itself instead of in Preferences.
Add-ons you unpin from the sidebar stay unpinned when you log in from another browser.
The AI Assistant no longer stops halfway through an answer when it calls a tool that takes no input.

Discovery:

An endpoint is rated quantum-safe only when both its key exchange and its certificate are, and an endpoint that has one of the two is rated partial.
ECDSA and Ed25519 certificates are no longer flagged as weak keys.
Discovery targets no longer disappear from the page when the KMS is unsealed by hand after a restart.

Security:

The container images are built on current Go, OpenSSL and Envoy releases, which fixes the known vulnerabilities in them.

Component versions:

First public available release of CyberVault KMS.

KMIP:

The HSM Partition configuration page now supports KMIP multi-tenancy: additional partitions (from the same HSM cluster) can be registered on the KMIP Server.
Added support for issuing KMIP mTLS client certificates via: generating the key pair directly in the HSM, signing an externally submitted CSR (the CSR is signed with the kms.kmip.user.ca issuing CA), and importing an existing certificate.
Added kmip-server property configuration on the KMIP dashboard.

TSB (on-premise deployments):

Deployment of TSB is now set to mTLS by default.
KMS creates an issuing CA key that is in the HSM (kms.tsb.user.ca). It signs the mTLS client certificates or CSR's for an on-prem TSB.

Keys & Certificates:

KMS raises an alert when key material leaves the HSM.
System keys are only visible to administrators, and deleting a system object asks for an explicit confirmation.
The Keys and Certificates tables can now be sorted and refreshed, and the certificate details view shows more.

Administration:

Component versions:

Initial release of CyberVault KMS.

Highlights:

Unified key management for HSM-backed keys, certificates, and password-protected keys, with improved metadata handling, filtering, lifecycle actions, and audit visibility.
Integrated KMIP, BYOK, and MCP, including KMIP-managed objects, provider-specific BYOK import and export flows, and built-in MCP server support for MCP-aware clients.
Built-in security and operations features such as HSM-native sealing and unsealing, role-based access control, alerting, audit logs, compliance reporting, and stronger validation across admin and authentication flows.
Support for post-quantum and crypto-agility use cases, including PQC certificate workflows, readiness tracking, and self-test capabilities.
Simplified deployment and day-2 operations with improved installers, Kubernetes and Helm deployment presets, optional TSB integration, and safer upgrade and uninstall behavior.

Component versions:

Get startedwith CloudHSM.

Other questions?Ask Sales.