Executive brief
OpenViking, an open-source framework for building AI-native applications, contains a security flaw in how it handles background tasks. Unauthorized users can access internal task information, including task status, result payloads, and resource identifiers, which should normally be private. This could allow an attacker to see what other users are doing or interfere with operations in environments where multiple customers share the same system.
Technical details
A missing authorization vulnerability (CWE-862) exists in OpenViking's task polling endpoints (/api/v1/tasks and /api/v1/tasks/{task_id}). The root cause is that these routes were mounted without request context validation, and the TaskTracker component stored tasks in a global namespace without ownership metadata. An unauthenticated remote attacker can exploit this to enumerate background tasks and retrieve sensitive metadata, including task types, status, resource identifiers, archive URIs, and result payloads. In multi-tenant deployments, this also allows for cross-tenant interference during asynchronous reindexing tasks. The issue is resolved in version 0.3.3 by enforcing end-to-end task ownership and requiring authentication for polling endpoints.
Affected products
- Volcengine OpenViking < 0.3.3
Timeline
- 2026-04-02: disclosed: Pull request submitted to fix ownership leakage
- 2026-04-03: patched: Version 0.3.3 released with security fixes
- 2026-04-07: advisory: CVE-2026-22680 published