Executive brief
OpenViking, an open-source platform for managing AI agents and bots, contains a security flaw in its bot proxy component. This vulnerability allows unauthorized individuals to bypass security checks and interact directly with connected AI backends without providing valid credentials. This could lead to unauthorized use of AI services and potential exposure of bot-related data.
Technical details
A missing authentication vulnerability (CWE-306) exists in the OpenViking bot proxy router. The issue stems from the 'verify_auth' function being optional and non-blocking in the request pipeline for specific endpoints. A remote, unauthenticated attacker can exploit this by sending specially crafted POST requests to the '/bot/v1/chat' and '/bot/v1/chat/stream' endpoints. Successful exploitation allows the attacker to bypass authentication checks and interact directly with the upstream bot backend. The vulnerability is resolved in version 0.2.14 by enforcing mandatory token extraction and validation for these routes.
Affected products
- Volcengine OpenViking 0.2.5 to 0.2.13
Timeline
- 2026-03-27: patched: Fix merged into main branch via Pull Request 996
- 2026-03-30: advisory: Official release of version 0.2.14 containing the fix
- 2026-04-01: disclosed: CVE published and NVD entry created