CVE-2026-115364
Description
A flaw was found in OpenBao. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by shutting down Agent and Proxy services. Due to a missing authorization check, administrative termination endpoints fail to validate the presence of the required security header even when header enforcement is enabled. An attacker could exploit this flaw, such as through Server-Side Request Forgery (SSRF), to trigger an unauthorized shutdown and disrupt availability.
Statement
This vulnerability is rated as Low severity because exploitation requires an existing Server-Side Request Forgery vulnerability or high-privileged network access to reach the administrative shutdown endpoints, and the impact is confined to a service disruption. OpenBao is not included or supported in Red Hat Enterprise Linux or standard Red Hat application runtimes. In environments where the service is operated, the issue solely affects process lifecycle termination without compromising secret confidentiality or system integrity.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Access Control
Technical Impact: Read Application Data; Modify Application Data; Execute Unauthorized Code or Commands; Gain Privileges or Assume Identity
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
