Skip to content
fr Sign in
2.1 Low

CVE-2026-115364 OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by…

Description

OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header. When require_request_header is enabled, attackers can send requests via server-side request forgery to /agent/v1/quit or /proxy/v1/quit to shut down these services.

Affected products and versions

Product Affected versions Fixed in
openbao 2.6 earliest → < 2.6.3 2.6.3

References

Timeline

  1. Published
  2. Last modified

Other CVEs of openbao

The 43 CVEs of openbao →
CVE-2026-115369 OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a… 2.1 Low CVE-2026-115366 OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged… 2.0 Low CVE-2026-115365 OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal 7.5 High CVE-2026-115363 OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the… 2.1 Low
Track this CVE