OpenBao versions prior to 2.6.3 have a missing authorization check on the /agent/v1/quit and /proxy/v1/quit endpoints. This flaw allows attackers to stop Agent and Proxy services by omitting the required X-Vault-Header when the require_request_header setting is enabled. The issue is fixed in version 2.6.3.