GHSA-8gmq-wv9h-fcwp: OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints

Q: Which deployments are exposed to this issue?

OpenBao versions before 2.6.3 are affected when Agent or Proxy services are running with require_request_header enabled. The vulnerable quit endpoints are /agent/v1/quit and /proxy/v1/quit.

Q: What does an attacker need to exploit it?

An attacker needs a way to send requests through server-side request forgery to an affected service. Exploitation relies on omitting the X-Vault-Header from requests to the quit endpoint.

Q: What is the impact of successful exploitation?

A successful request can stop the OpenBao Agent or Proxy service. The stated impact is loss of availability for those services.

Published Oct 22, 2026

Updated

OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header. When requirerequestheader is enabled, attackers can send requests via server-side request forgery to /agent/v1/quit or /proxy/v1/quit to shut down these services.

Affected Software

1 affected componentFixes available

bitnami/openbao<2.6.3

2.6.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade bitnami/openbao to a version that resolves this vulnerability.
Fixed in 2.6.3
Upgrade
Upgrade OpenBao to a version that resolves this vulnerability.
Fixed in 2.6.3
Configuration
Enable require_request_header to require the X-Vault-Header on Agent and Proxy requests.
OpenBao Agent/Proxy require_request_header = enabled

Event History

Oct 22, 2026

CVE Published

via OSV·07:13 PM

Data Sourced

via OSV·07:13 PM

DescriptionSeverityWeakness

Oct 29, 2026

Advisory Published

via OSV·08:54 AM

Data Sourced

via OSV·08:54 AM

Affected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

OpenBao versions before 2.6.3 are affected when Agent or Proxy services are running with require_request_header enabled. The vulnerable quit endpoints are /agent/v1/quit and /proxy/v1/quit.

What does an attacker need to exploit it?

An attacker needs a way to send requests through server-side request forgery to an affected service. Exploitation relies on omitting the X-Vault-Header from requests to the quit endpoint.

What is the impact of successful exploitation?

A successful request can stop the OpenBao Agent or Proxy service. The stated impact is loss of availability for those services.

GHSA-8gmq-wv9h-fcwp: OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?