Bug 2559315 (CVE-2026-115364)
| Summary: | CVE-2026-115364 github.com/openbao/openbao: openbao: Denial of Service via missing header check on quit endpoints | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in OpenBao. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by shutting down Agent and Proxy services. Due to a missing authorization check, administrative termination endpoints fail to validate the presence of the required security header even when header enforcement is enabled. An attacker could exploit this flaw, such as through Server-Side Request Forgery (SSRF), to trigger an unauthorized shutdown and disrupt availability.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-10-22 20:27:37 UTC
|