Skip to main content

OpenViking CVE-2026-75480

| EUVDEUVD-2026-60392 HIGH
Incorrect Authorization (CWE-863)
2026-08-17 VulnCheck GHSA-gpqq-qx8w-x7gh
Authentication Bypass Openviking
7.1
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
7.1 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

Network-accessible debug endpoints require only low-privilege account authentication (PR:L); scope unchanged as exposure is bounded to co-tenant account data; confidentiality is high due to secret material exposure, with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 17, 2026 - 21:07 vuln.today
CVE Published
Aug 17, 2026 - 20:36 cve.org
HIGH 7.1

DescriptionCVE.org

OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read all co-tenant records. Attackers can query these endpoints to retrieve private memories, resources, skills, and secret material belonging to other users in the same account without administrative privileges.

AnalysisAI

Incorrect authorization in OpenViking's debug vector scroll and count endpoints exposes all co-tenant records to any authenticated user within the same account. The storage backend in viking_vector_index_backend.py enforces only account-level scoping, with no per-user access controls, enabling lateral data theft of private memories, skills, resources, and secrets without administrative privileges. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain valid account credentials
Delivery
Identify debug scroll and count vector endpoint paths
Exploit
Issue unauthenticated-scope query to debug endpoint
Execution
Receive all co-tenant user records
Impact
Extract secrets and private material
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the attacker to hold valid authenticated credentials for the target OpenViking instance (PR:L confirmed by CVSS vector). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) reflects a network-reachable flaw requiring only low-privilege authentication, with no attack complexity or special prerequisites, and high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated user within a shared OpenViking account constructs a standard HTTP request to the debug vector scroll or count endpoint, omitting or ignoring user-scoping parameters. The backend returns records belonging to all co-tenant users in the account, exposing private memories, skill definitions, and secret material. …
Remediation No vendor-released patch has been identified at time of analysis; monitor GitHub issue https://github.com/volcengine/OpenViking/issues/3724 and the VulnCheck advisory at https://www.vulncheck.com/advisories/openviking-debug-vector-endpoints-multi-tenant-data-exposure for updates. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: identify all OpenViking deployments and immediately restrict network access to the debug vector scroll and count endpoints using firewalls, API gateways, or WAF rules; audit recent access logs for unauthorized lateral access patterns. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Openviking

View all
CVE-2026-40525 CRITICAL
9.1 Apr 17

OpenViking VikingBot OpenAPI routes permit unauthenticated remote attackers to execute privileged bot-control operations
CVE-2026-28518 HIGH
8.4 Mar 03

OpenViking 0.2.1 and earlier contain a path traversal vulnerability in .ovpack file imports that enables local attackers
CVE-2026-34999 MEDIUM
6.9 Apr 01

OpenViking versions 0.2.5 through 0.2.13 contain a missing authentication vulnerability in the bot proxy router that all
CVE-2026-22680 MEDIUM
6.9 Apr 07

OpenViking versions prior to 0.3.3 expose a missing authorization vulnerability in task polling endpoints that allows un
CVE-2026-13507 LOW
2.3 Jun 28

Insufficient data authenticity verification in volcengine OpenViking's Local VectorDB Primary-key Label Handler (version

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8
CVE-2017-4915 HIGH POC
7.8
CVE-2024-6782 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-75480 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy