PT-2026-22190 · Unknown · Openviking

Chia Min Jun Lennon · Published 2026-02-26 · Updated 2026-03-03 · CVE-2026-22207

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenViking versions prior to 0.1.19

Description The software contains a broken access control issue. Unauthenticated attackers can gain ROOT privileges when the root api key configuration is not set. Attackers can send requests to protected API endpoints without authentication headers, allowing access to administrative functions. These functions include account management, resource operations, and system configuration. The vulnerable API endpoints are accessible without proper authentication when the root api key is omitted.

Recommendations Update to version 0.1.19 or later. Ensure the root api key configuration is properly set to prevent unauthorized access.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-22207

Affected Products

Openviking

References · 12

• 🔥 https://github.com/volcengine/OpenViking/issues/302 · Exploit
• https://github.com/volcengine/OpenViking/commit/0251c7045b3f8092c4d2e1565115b1ba23db282f · Patch
• https://github.com/volcengine/OpenViking/pull/310 · Vendor Advisory
• https://github.com/volcengine/OpenViking/pull/310/changes/0251c7045b3f8092c4d2e1565115b1ba23db282f · Patch
• https://osv.dev/vulnerability/CVE-2026-22207 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22207 · Security Note
• https://twitter.com/CVEnew/status/2027466658357645695 · Twitter Post
• https://twitter.com/infoflowcloud/status/2027467799732383800 · Twitter Post
• https://t.me/cveNotify/153835 · Telegram Post
• https://twitter.com/cracbot/status/2028787686610473186 · Twitter Post
• https://twitter.com/TheHackerWire/status/2027473997869563938 · Twitter Post
• https://vulncheck.com/advisories/openviking-missing-root-api-key-allows-anonymous-root-access · Note