Is there a patch available for CVE-2026-13507?

Yes, a patch is available for CVE-2026-13507. Update the affected software to the latest version immediately.

OpenViking CVE-2026-13507

Q: What is the CVSS score of CVE-2026-13507?

CVE-2026-13507 has a CVSS 4.0 base score of 2.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-40004 LOW

Insufficient Verification of Data Authenticity (CWE-345)

2026-06-28 VulDB

GHSA-6rrp-mghv-q9rf

Information Disclosure Openviking Volcengine

2.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.3 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.0 MEDIUM

Network vector and high complexity match description; PR:L reflects authenticated low-privilege requirement; no scope change; all impacts capped at Low.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 28, 2026 - 22:21 vuln.today

Analysis Generated

Jun 28, 2026 - 22:21 vuln.today

DescriptionCVE.org

A vulnerability was detected in volcengine OpenViking up to 0.3.21. This affects the function str_to_uint64 of the file openviking/storage/vectordb/utils/str_to_uint64.py of the component Local VectorDB Primary-key Label Handler. The manipulation of the argument ID results in insufficient verification of data authenticity. The attack may be launched remotely. Attacks of this nature are highly complex. The exploitability is reported as difficult. The pull request to fix this issue awaits acceptance.

AnalysisAI

Insufficient data authenticity verification in volcengine OpenViking's Local VectorDB Primary-key Label Handler (versions up to 0.3.21) allows a remote attacker with low-privilege access to manipulate the ID argument passed to the str_to_uint64 function, potentially enabling limited tampering with vector database primary-key label data. The attack vector is network-accessible but rated highly complex, with CVSS 4.0 score of 2.3 reflecting constrained, low-severity impact across confidentiality, integrity, and availability. No public exploit code exists and no active exploitation has been identified; an upstream fix is pending via an unmerged pull request.

Technical ContextAI

OpenViking is a vector database framework developed by Volcengine (ByteDance's cloud platform). The vulnerable component is the str_to_uint64 function in openviking/storage/vectordb/utils/str_to_uint64.py, which converts string IDs to 64-bit unsigned integers used as primary keys in the vector storage layer. The root cause is CWE-345 (Insufficient Verification of Data Authenticity) - the function processes the ID argument without adequately confirming its provenance or integrity, potentially allowing a caller to supply a crafted identifier. However, a notable discrepancy exists: the referenced PR #2268 modifies crypto/providers.py rather than the declared file, strengthening HKDF key derivation by binding key_purpose and derivation_version into the HKDF info string. This mismatch suggests the CVE description may be imprecise about the exact locus of the flaw, or that the fix is broader than the description implies. The CPE cpe:2.3:a:volcengine:openviking:*:*:*:*:*:*:*:* covers all OpenViking versions up to and including 0.3.21.

RemediationAI

No released patched version has been confirmed - the upstream fix exists only as an unmerged pull request (https://github.com/volcengine/OpenViking/pull/2268) that adds versioned HKDF key derivation context in crypto/providers.py. Organizations should monitor the PR for merge and track an official tagged release. Until a patched release is available, compensating controls include restricting network access to the OpenViking VectorDB API to trusted internal clients only, enforcing authentication and authorization at the API gateway layer to prevent low-privilege accounts from submitting arbitrary ID values to the vector storage endpoints, and enabling audit logging on primary-key operations to detect anomalous ID patterns. Restricting API access adds latency and reduces accessibility for legitimate clients; log volume from audit logging may be significant in high-throughput deployments. VulDB entry: https://vuldb.com/cve/CVE-2026-13507.