CVE-2026-22680: OpenViking contains a missing authorization vulnerability in the task polling endpoints
(updated )
OpenViking versions prior to 0.3.3 contain a missing authorization vulnerability in the task polling endpoints that allows unauthorized attackers to enumerate or retrieve background task metadata created by other users. Attackers can access the /api/v1/tasks and /api/v1/tasks/{task_id} routes without authentication to expose task type, task status, resource identifiers, archive URIs, result payloads, and error information, potentially causing cross-tenant interference in multi-tenant deployments.
References
- github.com/advisories/GHSA-h336-2wxm-pr6q
- github.com/volcengine/OpenViking
- github.com/volcengine/OpenViking/commit/8c1c3f3608364ee0bb0e45f73478771a68aebdf5
- github.com/volcengine/OpenViking/pull/1182
- github.com/volcengine/OpenViking/releases/tag/v0.3.3
- nvd.nist.gov/vuln/detail/CVE-2026-22680
- www.vulncheck.com/advisories/openviking-missing-authorization-via-task-polling
Code Behaviors & Features
Detect and mitigate CVE-2026-22680 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →