CVE-2026-115364 | BDVDB-2026-394641 Detail

Description#

OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header. When require_request_header is enabled, attackers can send requests via server-side request forgery to /agent/v1/quit or /proxy/v1/quit to shut down these services.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-22Record published in the CVE List.
2. Version 22026-10-23Most recent update recorded in the CVE List.