CVE-2026-40525
CriticalSummary
OpenViking prior to version 0.3.9 contains an authentication bypass vulnerability in the VikingBot OpenAPI where the authentication check fails open when the api_key configuration value is unset or empty. Remote attackers can invoke privileged bot-control functionality without providing a valid X-API-Key header.
Risk Assessment
Attackers can exploit this vulnerability to gain control over the bot, potentially leading to unauthorized access to data, tools, and integrations. This poses a significant security risk to the organization.
Recommendation
It is recommended to update OpenViking to version 0.3.9 or later and to configure the api_key value to prevent unauthorized access. Additionally, conducting a security audit to identify potential threats is advisable.
Original NVD description (English source)
OpenViking prior to version 0.3.9 contains an authentication bypass vulnerability in the VikingBot OpenAPI HTTP route surface where the authentication check fails open when the api_key configuration value is unset or empty. Remote attackers with network access to the exposed service can invoke privileged bot-control functionality without providing a valid X-API-Key header, including submitting attacker-controlled prompts, creating or using bot sessions, and accessing downstream tools, integrations, secrets, or data accessible to the bot.