CVE-2026-40525
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
OpenViking prior to version 0.3.9 contains an authentication bypass vulnerability in the VikingBot OpenAPI HTTP route surface. When the api_key configuration value is unset or empty, the authentication check fails open, allowing remote attackers to access privileged bot-control functionality without providing a valid X-API-Key header.
Risk Assessment
The risk for the organization includes unauthorized control over the bot, potentially leading to data theft, access to integrations and tools, and misuse of the bot for malicious purposes.
Recommendation
It is recommended to immediately upgrade OpenViking to version 0.3.9 or later and set a strong, non-empty api_key in the configuration. Additionally, restrict network access to the API interface to trusted hosts only.
Original NVD description (English source)
OpenViking prior to version 0.3.9 contains an authentication bypass vulnerability in the VikingBot OpenAPI HTTP route surface where the authentication check fails open when the api_key configuration value is unset or empty. Remote attackers with network access to the exposed service can invoke privileged bot-control functionality without providing a valid X-API-Key header, including submitting attacker-controlled prompts, creating or using bot sessions, and accessing downstream tools, integrations, secrets, or data accessible to the bot.