CVE-2026-115364 — OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints
OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header. When require_request_header is…
Published: 2026-10-22 · CVSS: 2.1 · CVSS 4.0
OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header. When require_request_header is enabled, attackers can send requests via server-side request forgery to /agent/v1/quit or /proxy/v1/quit to shut down these services.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7