Low severity2.2NVD Advisory· Published Oct 22, 2026

CVE-2026-115364

Description

OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header. When require_request_header is enabled, attackers can send requests via server-side request forgery to /agent/v1/quit or /proxy/v1/quit to shut down these services.

Affected products

Openbao/Openbaollm-fuzzy
Range: <2.6.3

Patches

Vulnerability mechanics

References

github.com/openbao/openbao/security/advisories/GHSA-8gmq-wv9h-fcwpnvd
www.vulncheck.com/advisories/openbao-before-2.6.3-missing-header-check-on-agent-proxy-quit-endpointsnvd

News mentions

No linked articles in our index yet.

cvss	0.143
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000