CVE-2026-115364 Details
Description
OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header. When require_request_header is enabled, attackers can send requests via server-side request forgery to /agent/v1/quit or /proxy/v1/quit to shut down these services.
A vulnerability exists in OpenBao versions prior to 2.6.3, where a missing authorization check allows for the unauthorized termination of Agent and Proxy services. This issue arises when the 'require_request_header' option is enabled, as the 'X-Vault-Header' is not properly enforced on requests to the quit endpoints. Attackers can exploit this vulnerability by sending server-side request forgery (SSRF) requests to '/agent/v1/quit' or '/proxy/v1/quit', effectively shutting down these services. While a similar exploitation is possible for the cache-clear endpoints, it does not present a significant security risk.
Users can upgrade to OpenBao versions 2.6.3 or 2.7.0 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 22, 2026CISA-ADP
Assessed Oct 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openbao/openbao/security/advisories/GHSA-8gmq-wv9h-fcwp | [email protected] | AdvisoryRemedyVendor |
| https://www.vulncheck.com/advisories/openbao-before-2.6.3-missing-header-check-on-agent-proxy-quit-endpoints | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenBao | < 2.6.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 23, 2026 | CVE Modified | CISA-ADP |
| Oct 22, 2026 | New CVE Received | [email protected] |