Volcengine OpenViking up to 0.3.2 Task Polling Endpoint /api/v1/tasks task_id authorization

Summaryinfo

A vulnerability has been found in Volcengine OpenViking up to 0.3.2 and classified as problematic. This affects an unknown function of the file /api/v1/tasks of the component Task Polling Endpoint. Performing a manipulation of the argument task_id results in authorization. This vulnerability is cataloged as CVE-2026-22680. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic has been found in Volcengine OpenViking up to 0.3.2. This affects an unknown part of the file /api/v1/tasks of the component Task Polling Endpoint. The manipulation of the argument task_id with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality. The summary by CVE is:

OpenViking versions prior to 0.3.3 contain a missing authorization vulnerability in the task polling endpoints that allows unauthorized attackers to enumerate or retrieve background task metadata created by other users. Attackers can access the /api/v1/tasks and /api/v1/tasks/{task_id} routes without authentication to expose task type, task status, resource identifiers, archive URIs, result payloads, and error information, potentially causing cross-tenant interference in multi-tenant deployments.

The weakness was shared by Chia Min Jun Lennon. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-22680 since 01/08/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available.

Upgrading to version 0.3.3 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 8c1c3f3608364ee0bb0e45f73478771a68aebdf5 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-19744). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Volcengine

Name

• OpenViking

Version

• 0.3.0
• 0.3.1
• 0.3.2

License

• open-source

Website

• Product: https://github.com/volcengine/OpenViking/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion