OpenBao before version 2.6.3 contains an authorization omission that permits an attacker to terminate the Agent and Proxy services by sending requests to /agent/v1/quit or /proxy/v1/quit without the required X‑Vault‑Header. The flaw elevates a simple HTTP request to a destructive operation, resulting in a denial of service whenever the quit endpoint is activated. The weakness is rooted in CWE‑862, Missing Authorization.

All installations of the openbao product running a pre‑2.6.3 version are potentially impacted. The vulnerability description does not enumerate exact sub‑versions, so any deployment of openbao before the 2.6.3 release should be considered vulnerable.

The CVSS score of 2.1 indicates a low severity rating, and the EPSS score is not reported, suggesting limited publicly known exploitation. The exploit can proceed via server‑side request forgery, so an attacker must first be able to trigger SSRF against the openbao instance, which typically requires network reconnaissance or compromised internal services. Because the impact is a service shutdown rather than data exfiltration or code execution, the overall risk is lower, but in environments where the Agent or Proxy services are critical, the denial of service could have significant operational consequences. The vulnerability is not listed in the CISA KEV catalog, reducing the likelihood of widespread exploitation at this time.