CVE-2026-22207OpenViking Missing root_api_key Allows Anonymous ROOT Access
Updated under an hour ago ()
Does this affect you?
It affects Volcengine OpenViking. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
OpenViking through version 0.1.18, prior to commit 0251c70, contains a broken access control vulnerability that allows unauthenticated attackers to gain ROOT privileges when the root_api_key configuration is omitted. Attackers can send requests to protected endpoints without authentication headers to access administrative functions including account management, resource operations, and system configuration.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-306
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- VulnCheck
- NVD analysis
- Deferred
- Record last updated
- Jul 14, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Volcengine OpenViking volcengine:openviking (from the name) | through 0.1.18; 0251c7045b3f8092c4d2e1565115b1ba23db282f not affected | CNA record |
References
- https://github.com/volcengine/OpenViking/issues/302issue-tracking
- https://github.com/volcengine/OpenViking/pull/310issue-tracking
- https://github.com/volcengine/OpenViking/commit/0251c7045b3f8092c4d2e1565115b1ba23db282fpatch
- https://www.vulncheck.com/advisories/openviking-missing-root-api-key-allows-anonymous-root-accessthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.