BIT-openbao-2026-115364: OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints
OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header. When requirerequestheader is enabled, attackers can send requests via server-side request forgery to /agent/v1/quit or /proxy/v1/quit to shut down these services.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bitnami/openbaoto a version that resolves this vulnerability.Fixed in 2.6.3 - Upgrade
Upgrade
OpenBaoto a version that resolves this vulnerability.Fixed in 2.6.3
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
OpenBao deployments before 2.6.3 are affected when require_request_header is enabled and Agent or Proxy quit endpoints are reachable through a server-side request forgery path.
What does an attacker need to exploit the issue?
The attacker needs a way to cause server-side requests to /agent/v1/quit or /proxy/v1/quit. Exploitation relies on omitting the X-Vault-Header from those requests.
What is the impact of successful exploitation?
A successful request can stop the OpenBao Agent or Proxy service. The supplied severity data indicates an availability impact limited to the vulnerable component, with no stated confidentiality or integrity impact.
How can teams determine whether they are affected?
Check whether the deployed OpenBao version is earlier than 2.6.3, whether require_request_header is enabled, and whether an SSRF-capable application or service can reach the Agent or Proxy quit endpoints.