CVE-2026-115364: OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints

Severity: low (CVSS 2.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-22 · updated 2026-10-23
Weakness: CWE-862

Description

OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header. When require_request_header is enabled, attackers can send requests via server-side request forgery to /agent/v1/quit or /proxy/v1/quit to shut down these services.

Affected products

openbao: before 2.6.3 — fixed in 2.6.3

How to fix

Upgrade to a fixed version: openbao 2.6.3. Check the vendor advisory for mitigations.

References

https://github.com/openbao/openbao/security/advisories/GHSA-8gmq-wv9h-fcwp
https://www.vulncheck.com/advisories/openbao-before-2.6.3-missing-header-check-on-agent-proxy-quit-endpoints

Get alerted when CVE-2026-115364 or the next vulnerability affects your stack