Executive brief
OpenViking, an open-source framework for building AI bot services, contains a security flaw where its management interface fails to require a password if one hasn't been explicitly set. This allows anyone with network access to the service to take control of the AI bot, view private chat sessions, and access any internal tools or data the bot is connected to. Organizations using this software should update to the latest version to ensure the system 'fails closed' and remains secure by default.
Technical details
An authentication bypass vulnerability exists in OpenViking's VikingBot OpenAPI HTTP route surface due to a 'fail-open' condition. When the `api_key` or per-channel API key configuration values are unset or empty, the authentication middleware fails to enforce security checks on privileged endpoints such as `/bot/v1/chat`, `/bot/v1/sessions`, and `/bot/v1/chat/channel`. A remote, unauthenticated attacker can send requests to these endpoints without a valid `X-API-Key` header to submit prompts, manage bot sessions, and access integrated secrets or downstream tools. The vulnerability is addressed in version 0.3.9 by ensuring these routes return a 503 error unless an explicit API key is configured.
Affected products
- volcengine OpenViking prior to 0.3.9
Timeline
- 2026-04-14: disclosed: Pull request submitted to address the vulnerability
- 2026-04-16: patched: Fix merged into main branch and version 0.3.9 released
- 2026-04-17: advisory: CVE-2026-40525 published