Kv get returns error "The system cannot find the path specified."

Vault
1

Hello - we have a Vault standalone installation which was working fine on v1.15.4. I upgraded it today to v1.18.2 and I’m unable to retrieve one specific kv pair, out of the many that are configured and working fine. I have a structure like so:

secret/data/mytest/test1
secret/data/mytest/test2
secret/data/mytest/uat

I can retrieve everything except for uat. When I try to get the uat secret I get the following (this is edited to remove the specifics of our installation names):

Error making API request. Code: 500. Errors: The system cannot find the path specified.

For the uat secret only, nothing works. I cannot get, patch, put, metadata - nothing. Its almost as if that one specific secret has somehow become corrupted.

If I rollback to v1.15.4 of the Vault executable, everything works fine. I can access and get all of the secrets, including uat, using the exact same commands.

I’m still learning Vault but I’m at a loss. All I see in the Vault logs / audit logs is the same 500 error with nothing additional. Any ideas as to what might have happened here?

Thanks!

2

Just a quick follow up - I tried two additional tests. Firstly, I tried a smaller upgrade, to v.1.16.3. This made no difference, I was still unable to access the uat secret.

Second, I made another secret, with the exact same contents as uat but in a different location under /secret/data. I was able to access this fine, on both versions, so this issue is somehow isolated to just that one secret. I can see no information in the log to indicate why (or how) it became inaccessible. Any ideas on how to troubleshoot this?

3

One final update. After the Code 500 Errors, there is an additional message basically saying that the path /Vault/data/ was not found. Turns out that the path printed is truncated at 260 characters, which happens to be the maximum length of a path under Windows. When I take that path and navigate through it on the actual filesystem, its actually longer - around 270 characters including the drive letter.

So I’ve gone and moved our Vault instance to Linux which doesn’t have this constraint.

The main question remains however - if this path was too long, why did it work on v1.15.4? The uat secret was initially created in this version - does Vault somehow cache the secrets created while its running so that it can retrieve them quickly and not have to navigate to the underlying path?