CVE-2026-115364

Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.6.3

Description A missing authorization check allows attackers to stop Agent and Proxy services by omitting the X-Vault-Header. When the require request header setting is enabled, attackers can utilize server-side request forgery (SSRF)—a technique that allows an attacker to induce the server-side application to make requests to an unintended location—to send requests to the '/agent/v1/quit' and '/proxy/v1/quit' endpoints to shut down these services.

Recommendations Update to version 2.6.3 or later.