2.1
Faible
CVE-2026-115364 OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by…
Description
OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header. When require_request_header is enabled, attackers can send requests via server-side request forgery to /agent/v1/quit or /proxy/v1/quit to shut down these services.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| openbao 2.6 | premières → < 2.6.3 | 2.6.3 |
Références
Chronologie
- Publiée
- Dernière modification
Autres CVE de openbao
Les 43 CVE de openbao →
CVE-2026-115369
OpenBao from 2.5.0 before 2.6.2 fails to enforce the PKI role allowed_ip_sans_cidr restriction on IP SANs taken from a…
2.1
Faible
CVE-2026-115366
OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged…
2.0
Faible
CVE-2026-115365
OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal
7.5
Élevée
CVE-2026-115363
OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the…
2.1
Faible