OpenBao before version 2.6.3 contains an authorization omission that permits an attacker to terminate the Agent and Proxy services by sending requests to /agent/v1/quit or /proxy/v1/quit without the required X-Vault-Header. The flaw elevates a simple HTTP request to a destructive operation, resulting in a denial of service whenever the quit endpoint is activated. The weaknesses are rooted in CWE‑862 (Missing Authorization) and CWE‑425 (Missing Required Header).

All installations of the openbao product running a pre-2.6.3 version are potentially impacted. The vulnerability description does not enumerate exact sub-versions, so any deployment of openbao before the 2.6.3 release should be considered vulnerable.

The CVSS score of 2.1 indicates a low severity rating, and the EPSS score of <1% indicates a very low probability of exploitation at this time. The exploit can proceed via server‑side request forgery, so an attacker must first be able to trigger SSRF against the openbao instance, which typically requires internal network access or a prior compromise of an internal service. Because the impact is limited to shutting down the Agent or Proxy services, there is no direct threat to data confidentiality or integrity, but the denial of service can disrupt critical operations. The vulnerability is not listed in the CISA KEV catalog, further reducing the likelihood of widespread exploitation.