Authorization Bypass in OpenBao Affects Agent and Proxy Services
CVE-2026-115364

2.1LOW

Key Information:

Vendor

Openbao

Status
Openbao
Vendor
CVE Published:
22 October 2026

What is CVE-2026-115364?

Prior to version 2.6.3, OpenBao suffers from a missing authorization check which could be exploited by malicious actors. By omitting the X-Vault-Header, attackers can craft server-side request forgery (SSRF) attacks to terminate essential Agent and Proxy services by sending requests to the /agent/v1/quit or /proxy/v1/quit endpoints. This vulnerability highlights the importance of strict validation on critical API requests.

Affected Version(s)

openbao 0 < 2.6.3

openbao 2.6.3

References

https://github.com/openbao/openbao/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/openbao-before-2.6.3...
third-party-advisory

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

MarcIlunga
Luiggi33
cipherboy
.