CVE-2026-115364

LOW 2.2

OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints

CVSS Score

2.2

EPSS Score

0.0%

EPSS Percentile

0th

OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header. When require_request_header is enabled, attackers can send requests via server-side request forgery to /agent/v1/quit or /proxy/v1/quit to shut down these services.

CWE	CWE-862
Vendor	openbao
Product	openbao
Published	Oct 22, 2026

Stay Ahead of the Next One

Get instant alerts for openbao openbao

Be the first to know when new low vulnerabilities affecting openbao openbao are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Affected Versions

openbao / openbao

0 < 2.6.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/openbao/openbao/security/advisories/GHSA-8gmq-wv9h-fcwp vulncheck.com: https://www.vulncheck.com/advisories/openbao-before-2.6.3-missing-header-check-on-agent-proxy-quit-endpoints

Credits

🔍 MarcIlunga Luiggi33 cipherboy