Live › vulnerability › CVE-2026-115364
Go to dashboardOpenBao before 2.6.3 does not check authorization on the Agent and Proxy quit endpoints when the X-Vault-Header is omitted. An attacker can send requests via server-side request forgery to /agent/v1/quit or /proxy/v1/quit and shut those services down.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running OpenBao Agent or Proxy with require_request_header enabled are exposed, since that is the setting the sources name as the trigger. The impact is a denial of service on those services, not data access. Teams not running Agent or Proxy, or running a version at or above 2.6.3, can skip it.
No product ranges from the sources yet.
bao version; versions below 2.6.3 are affectedrequire_request_header is enabled in the Agent or Proxy configuration2.6.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header. When require_request_header is enabled, attackers can send requests via server-side request forgery to /agent/v1/quit or /proxy/v1/quit to shut down these services.
This page as .md · .json · in your agent: get_signal("CVE-2026-115364")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.