OpenViking CVE-2026-22681

Exploitation requires a valid low-privilege account on the OpenViking instance (PR:L per CVSS 4.0 vector). No special non-default configuration is required - the vulnerable fetch pipeline is active by default in all versions before 0.3.4 for any user who can POST to /api/v1/resources. The highest-impact variant (cloud IAM credential theft) additionally requires the OpenViking server to be hosted in a cloud environment where IMDSv1 is reachable (i.e., IMDSv2-only hop-count enforcement is not in place). Internal network enumeration is possible in any deployment where the server process can reach RFC 1918 or loopback addresses, which is the default on most operating systems. The redirect-following behavior (follow_redirects=True in httpx) amplifies the attack surface by enabling open-redirect chains through public hosts to bypass naive hostname-based filters. Authentication is the sole limiting factor; there is no requirement for admin access, specific feature enablement, or non-default deployment mode.

The CVSS 4.0 score of 8.3 appropriately reflects AV:N/AC:L/AT:N/PR:L with high confidentiality impact on both the vulnerable system (VC:H) and subsequent systems (SC:H), the latter capturing cloud metadata and internal service exposure. The single meaningful gating factor is PR:L - a valid low-privilege account is required. In cloud deployments where IMDSv1 is accessible, the blast radius is severe: an attacker can retrieve IAM role credentials from 169.254.169.254 and escalate beyond the OpenViking application. In isolated on-premises environments without cloud metadata, the risk is limited to internal service enumeration and interaction. No CISA KEV listing exists and no EPSS data was provided in the input, so widespread active exploitation cannot be confirmed. Real-world priority should be treated as high for any cloud-hosted OpenViking instance with IMDSv1 enabled, and moderate for on-premises deployments. The low attack complexity and absence of any non-default configuration requirement mean that any authenticated user can exploit this without specialized knowledge.

An attacker with a valid low-privilege OpenViking account sends POST /api/v1/resources with a body containing the URL http://169.254.169.254/latest/meta-data/iam/security-credentials/ and the server, lacking destination validation, fetches the metadata endpoint and stores the response. The attacker then retrieves the IAM role credentials through the standard content retrieval API, using them to call AWS APIs directly and escalate privileges beyond the OpenViking application boundary. No public exploit code is required - the attack path is mechanically straightforward given the description and commit diff.