CVE-2026-40525
OpenViking prior to commit c7bb167 contains an authentication bypass vulnerability in the VikingBot OpenAPI HTTP route surface where the authentication check fails open when the api_key configuration value is unset or empty. Remote attackers with network access to the exposed service can invoke privileged bot-control functionality without providing a valid X-API-Key header, including submitting attacker-controlled prompts, creating or using bot sessions, and accessing downstream tools, integrations, secrets, or data accessible to the bot.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.1
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.57%
- CWE
- CWE-636
- Published
- 2026-04-17
- Last modified
- 2026-07-14
Affected products
- volcengine OpenViking
- volcengine OpenViking
Weakness type
Related vulnerabilities
- CVE-2026-81379 — Visual Studio Code Security Feature Bypass Vulnerability
- CVE-2026-86120 — APITable through 1.13.0-beta.1 Fail-Open Authorization in the Fusion API Node Permission Guard
- CVE-2026-85649 — (Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation...
- CVE-2026-18329 — NGINX ngx_http_js_module vulnerability
- CVE-2026-82744 — Ash.Reactor change step fails open, skipping a change when its where guard raises
- CVE-2026-82018 — IGEL OS 12 / 11 Secure Boot Bypass via Unsigned igel.conf File
- CVE-2026-46482 — MyBB: Security Question insufficient validation
- CVE-2026-73421 — NextAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)