CVE-2026-115364: 
Wolfi vulnerability analysis and mitigation

CVE-2026-115364 is a missing authorization vulnerability in OpenBao's Agent and Proxy services that allows attackers to shut down these services by omitting the X-Vault-Header when require_request_header is enabled. The flaw affects all OpenBao versions before 2.6.3 and is noted to be original to HashiCorp Vault. It was published on October 22, 2026, with a patch available in OpenBao v2.6.3 and v2.7.0. The vulnerability carries a CVSS v3.1 base score of 2.2 (Low) and a CVSS v4.0 base score of 2.1 (Low) (GitHub Advisory, VulnCheck).

The root cause is classified as CWE-862 (Missing Authorization). OpenBao's Agent and Proxy services support a require_request_header = true configuration option intended to mitigate Server-Side Request Forgery (SSRF) attacks by requiring the X-Vault-Header on all incoming requests. However, the quit endpoints (/agent/v1/quit and /proxy/v1/quit) — and similarly the cache-clear endpoints (/agent/v1/cache-clear and /proxy/v1/cache-clear) — failed to enforce this header check, allowing requests without the required header to be processed. An attacker with high privileges could exploit this via SSRF to send unauthenticated requests to these endpoints and terminate the Agent or Proxy service (GitHub Advisory).

Successful exploitation results in a limited availability impact: an attacker can forcibly shut down OpenBao Agent or Proxy services, disrupting secrets management workflows that depend on these components. There is no confidentiality or integrity impact, and no lateral movement or data exposure risk is associated with this vulnerability. The scope is limited to the vulnerable system itself, with no subsequent system impact (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-115364. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high privileges and the specific precondition that require_request_header is enabled, significantly limiting the attack surface (VulnCheck).

1. Precondition Check: Confirm the target OpenBao deployment is running an Agent or Proxy service with require_request_header = true configured and is running a version prior to 2.6.3.
2. Obtain High-Privilege Access: Acquire credentials or a session with high-privilege access to the environment, as the vulnerability requires elevated privileges to exploit.
3. Identify SSRF Vector: Locate a server-side request forgery vector within the environment that can be used to send HTTP requests to the OpenBao Agent or Proxy's internal listener.
4. Craft Malicious Request: Construct an HTTP PUT or POST request targeting /agent/v1/quit or /proxy/v1/quit, deliberately omitting the X-Vault-Header that would normally be required.
5. Send Request via SSRF: Deliver the crafted request through the SSRF vector to the Agent or Proxy service endpoint.
6. Service Shutdown: The Agent or Proxy service processes the request without enforcing the header check and shuts down, disrupting secrets management operations (GitHub Advisory).

• Logs: Unexpected or unexplained shutdown events in OpenBao Agent or Proxy service logs, particularly without a corresponding administrative action; log entries showing requests to /agent/v1/quit or /proxy/v1/quit lacking the X-Vault-Header.
• Network: Inbound HTTP requests to Agent/Proxy quit or cache-clear endpoints (/agent/v1/quit, /proxy/v1/quit, /agent/v1/cache-clear, /proxy/v1/cache-clear) from unexpected or internal sources indicative of SSRF.
• Process: Sudden termination of the OpenBao Agent or Proxy process without operator-initiated action or system-level cause.

Upgrade OpenBao to version 2.6.3 or 2.7.0, both of which contain the patch for this vulnerability. As a temporary workaround, operators can restrict network access to the Agent and Proxy listener endpoints using firewall rules or network policies to prevent unauthorized requests from reaching the quit and cache-clear endpoints. Disabling require_request_header is not a recommended workaround, as it removes SSRF protections (GitHub Advisory).

The advisory was published by OpenBao maintainer cipherboy, with MarcIlunga credited as the reporter and Luiggi33 as the remediation developer. No significant broader media coverage or notable community commentary beyond the official advisory has been identified at this time (GitHub Advisory).