CVE-2026-115364: OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints

Q: Which deployments are exposed to this issue?

OpenBao deployments before 2.6.3 are affected when require_request_header is enabled and Agent or Proxy quit endpoints are reachable through a server-side request forgery path.

Q: What does an attacker need to exploit it?

The attacker needs the ability to cause server-side request forgery requests to /agent/v1/quit or /proxy/v1/quit. They exploit the missing authorization check by omitting the X-Vault-Header.

Q: What is the impact of successful exploitation?

Successful exploitation can stop OpenBao Agent or Proxy services. The provided severity vector indicates an availability impact only, with no confidentiality or integrity impact.

Q: What should be done if immediate upgrading is not possible?

The provided information identifies SSRF access to the quit endpoints as the exploitation path. Restricting or eliminating SSRF paths to /agent/v1/quit and /proxy/v1/quit can reduce exposure until OpenBao is updated.

Published Oct 22, 2026

Updated

OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header. When requirerequestheader is enabled, attackers can send requests via server-side request forgery to /agent/v1/quit or /proxy/v1/quit to shut down these services.

Affected Software

1 affected component

OpenBao OpenBao<2.6.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenBao to a version that resolves this vulnerability.
Fixed in 2.6.3

Event History

Oct 22, 2026

CVE Published

via MITRE·07:13 PM

Data Sourced

via MITRE·07:13 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

OpenBao deployments before 2.6.3 are affected when require_request_header is enabled and Agent or Proxy quit endpoints are reachable through a server-side request forgery path.

What does an attacker need to exploit it?

The attacker needs the ability to cause server-side request forgery requests to /agent/v1/quit or /proxy/v1/quit. They exploit the missing authorization check by omitting the X-Vault-Header.

What is the impact of successful exploitation?

Successful exploitation can stop OpenBao Agent or Proxy services. The provided severity vector indicates an availability impact only, with no confidentiality or integrity impact.

What should be done if immediate upgrading is not possible?

The provided information identifies SSRF access to the quit endpoints as the exploitation path. Restricting or eliminating SSRF paths to /agent/v1/quit and /proxy/v1/quit can reduce exposure until OpenBao is updated.

CVE-2026-115364: OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

What should be done if immediate upgrading is not possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

What should be done if immediate upgrading is not possible?