CVE-2026-40525

CRITICAL EPSS 42.9%
Published Apr 17, 20262mo ago · Modified Jun 17, 20262w ago
9.1 CVSS 4.0
Critical
Find Similar
Published Apr 17, 2026 2mo ago
Last Modified Jun 17, 2026 2w ago

Description

OpenViking prior to version 0.3.9 contains an authentication bypass vulnerability in the VikingBot OpenAPI HTTP route surface where the authentication check fails open when the api_key configuration value is unset or empty. Remote attackers with network access to the exposed service can invoke privileged bot-control functionality without providing a valid X-API-Key header, including submitting attacker-controlled prompts, creating or using bot sessions, and accessing downstream tools, integrations, secrets, or data accessible to the bot.

CVSS Details

Base Score
9.1
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
42.9% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-636

Affected Products 1

VendorProductVersionRange
volcengineopenviking* <0.3.9

References 4

  • github.com https://github.com/volcengine/OpenViking/commit/c7bb1676f4d037609f041bf39e4e2bd52e8f9820
    Patch
  • github.com https://github.com/volcengine/OpenViking/pull/1447
    ExploitPatchVendor Advisory
  • github.com https://github.com/volcengine/OpenViking/releases/tag/v0.3.9
    Release Notes
  • vulncheck.com https://www.vulncheck.com/advisories/openviking-authentication-bypass-via-vikingbot-openapi
    Third Party Advisory

Remediation

  • github.com https://github.com/volcengine/OpenViking/commit/c7bb1676f4d037609f041bf39e4e2bd52e8f9820
    Patch
  • github.com https://github.com/volcengine/OpenViking/pull/1447
    ExploitPatchVendor Advisory