PT-2026-33478 · Unknown · Openviking

Hinotoi-Agent · Published 2026-04-17 · Updated 2026-05-12 · CVE-2026-40525

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenViking versions prior to commit c7bb167

Description An authentication bypass exists in the VikingBot OpenAPI HTTP route surface. The issue occurs when the api key configuration value is unset or empty, causing the authentication check to fail open. Remote attackers with network access to the exposed service can invoke privileged bot-control functionality without providing a valid 'X-API-Key' header. This allows for the submission of attacker-controlled prompts, the creation or use of bot sessions, and unauthorized access to downstream tools, integrations, secrets, or data accessible to the bot.

Recommendations Update OpenViking to commit c7bb167 or a newer version. Ensure the api key configuration value is properly set and not left empty.

Fix

RCE

Weakness Enumeration

CWE-636

Related Identifiers

CVE-2026-40525

GHSA-JGQ2-VQ69-GR6H

Affected Products

Openviking

References · 12

• https://github.com/volcengine/OpenViking/pull/1447 · Vendor Advisory
• https://github.com/volcengine/OpenViking/commit/c7bb1676f4d037609f041bf39e4e2bd52e8f9820 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40525 · Security Note
• https://osv.dev/vulnerability/GHSA-jgq2-vq69-gr6h · Vendor Advisory
• https://github.com/volcengine/OpenViking/releases/tag/v0.3.9 · Note
• https://github.com/volcengine/OpenViking · Note
• https://twitter.com/0dayPublishing/status/2045210618441916437 · Twitter Post
• https://twitter.com/CVEnew/status/2045889717489512701 · Twitter Post
• https://t.me/cveNotify/162217 · Telegram Post
• https://twitter.com/OrizonCyber/status/2045230869992944013 · Twitter Post
• https://vulncheck.com/advisories/openviking-authentication-bypass-via-vikingbot-openapi · Note
• https://twitter.com/lyrie_ai/status/2054224253214425485 · Twitter Post