diff --git a/changelog/28631.txt b/changelog/28631.txt new file mode 100644 index 000000000000..a4857ea11233 --- /dev/null +++ b/changelog/28631.txt @@ -0,0 +1,3 @@ +```release-note:bug +core/seal: Fix an issue that could cause reading from sys/seal-backend-status to return stale information. +``` diff --git a/vault/logical_system.go b/vault/logical_system.go index c7f2c162b561..8603c9ae4b87 100644 --- a/vault/logical_system.go +++ b/vault/logical_system.go @@ -5641,7 +5641,16 @@ func (c *Core) GetSealBackendStatus(ctx context.Context) (*SealBackendStatusResp if err != nil { return nil, fmt.Errorf("could not list partially seal wrapped values: %w", err) } - genInfo := c.seal.GetAccess().GetSealGenerationInfo() + // When multi-seal is enabled, use the stored seal generation information. Note that the in-memory + // value may not be up-to-date on non-active nodes. + genInfo, err := PhysicalSealGenInfo(ctx, c.physical) + if err != nil { + return nil, fmt.Errorf("could not read seal generation information: %w", err) + } + if genInfo == nil { + // Multi-seal is not enabled, use the in-memory value. + genInfo = c.seal.GetAccess().GetSealGenerationInfo() + } r.FullyWrapped = genInfo.IsRewrapped() && len(pps) == 0 return &r, nil }