CVE-2026-22681
HighCVSS 8.5Summary
OpenViking before version 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the resources API endpoint.
Risk Assessment
An attacker can access internal services such as cloud metadata, potentially leading to credential leakage or system integrity compromise.
Recommendation
Upgrade OpenViking to version 0.3.4 or later, which includes a fix for the SSRF vulnerability.
Other vulnerabilities in OpenViking
See all- CVE-2026-40525Critical
OpenViking prior to version 0.3.9 contains an authentication bypass vulnerability in the VikingBot OpenAPI HTTP route surface. When the api_key configuration value is unset or empty, the authentication check fails open, allowing remote attackers to access privileged bot-control functionality without providing a valid X-API-Key header.
- CVE-2026-75480Medium
OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read all co-tenant records. Attackers can retrieve private memories, resources, skills, and secret material of other users in the same account.
- CVE-2026-13507Medium
A vulnerability was found in the Local VectorDB Primary-key Label Handler component of OpenViking up to version 0.3.21, where insufficient verification of data authenticity occurs when processing the ID argument in the str_to_uint64 function. The attack can be launched remotely but is highly complex and difficult to exploit.
- CVE-2026-22680Medium
OpenViking versions prior to 0.3.3 have a missing authorization vulnerability in task polling endpoints. Unauthenticated attackers can enumerate or retrieve background task metadata created by other users, including task type, status, resource identifiers, archive URIs, result payloads, and error information.
- CVE-2026-34999Medium
OpenViking versions 0.2.5 through 0.2.13 contain a missing authentication vulnerability in the bot proxy router that allows remote unauthenticated attackers to access protected bot proxy functionality by sending requests to the POST /bot/v1/chat and POST /bot/v1/chat/stream endpoints. Attackers can bypass authentication checks and interact directly with the upstream bot backend through the OpenViking proxy without providing valid credentials.
- CVE-2026-28518High
OpenViking versions 0.2.1 and prior, fixed in commit 46b3e76, contain a path traversal vulnerability in the .ovpack import handling. Attackers can craft malicious ZIP archives with traversal sequences, absolute paths, or drive prefixes to overwrite or create arbitrary files with the importing process privileges.
Original NVD description (English source)
OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the resources API endpoint. Attackers can POST a crafted URL to /api/v1/resources, causing the server to issue outbound HEAD and GET requests with redirects enabled to loopback, RFC 1918, link-local, or cloud metadata addresses, then read back responses through normal content APIs to enumerate and interact with internal services.