volcengine OpenViking up to 0.3.8 Exposed Service api_key failing open

Summaryinfo

A vulnerability classified as critical was found in volcengine OpenViking up to 0.3.8. This impacts an unknown function of the component Exposed Service. The manipulation of the argument api_key results in failing open. This vulnerability is reported as CVE-2026-40525. The attack can be launched remotely. No exploit exists. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability classified as critical has been found in volcengine OpenViking up to 0.3.8. Affected is an unknown function of the component Exposed Service. The manipulation of the argument api_key with an unknown input leads to a failing open vulnerability. CWE is classifying the issue as CWE-636. When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

OpenViking prior to commit c7bb167 contains an authentication bypass vulnerability in the VikingBot OpenAPI HTTP route surface where the authentication check fails open when the api_key configuration value is unset or empty. Remote attackers with network access to the exposed service can invoke privileged bot-control functionality without providing a valid X-API-Key header, including submitting attacker-controlled prompts, creating or using bot sessions, and accessing downstream tools, integrations, secrets, or data accessible to the bot.

The weakness was disclosed by Chia Min Jun Lennon. The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-40525 since 04/13/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available.

Applying the patch c7bb1676f4d037609f041bf39e4e2bd52e8f9820 is able to eliminate this problem. The bugfix is ready for download at github.com.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• volcengine

Name

• OpenViking

Version

• 0.3.0
• 0.3.1
• 0.3.2
• 0.3.3
• 0.3.4
• 0.3.5
• 0.3.6
• 0.3.7
• 0.3.8

License

• open-source

Website

• Product: https://github.com/volcengine/OpenViking/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion