Is CVE-2026-40525 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40525 being exploited in the wild.

How severe is CVE-2026-40525?

Critical severity, with a CVSS score of 9.1, published 17 April 2026.

Which products and versions are affected?

openviking (PyPI) < 0.3.9, ECOSYSTEM:introduced=0,fixed=0.3.9.

Is there a fix for CVE-2026-40525?

Yes. openviking (PyPI): upgrade to 0.3.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-40525 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-40525?

Check whether you run openviking (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40525: volcengine OpenViking authentication bypass in VikingBot OpenAPI

Q: Which products and versions are affected?

openviking (PyPI) < 0.3.9, ECOSYSTEM:introduced=0,fixed=0.3.9.

Q: Is there a fix for CVE-2026-40525?

Yes. openviking (PyPI): upgrade to 0.3.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-40525 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-40525?

Check whether you run openviking (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40525 · Severity: critical · CVSS 9.1 · Published 2026-04-17

OpenViking, an open-source framework for building AI bot services, contains a security flaw where its management interface fails to require a password if one hasn't been explicitly set. This allows anyone with network access to the service to take control of the AI bot, view private chat sessions, and access any internal tools or data the bot is connected to. Organizations using this software should update to the latest version to ensure the system 'fails closed' and remains secure by default.

Technologies: openviking (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-40525 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40525 being exploited in the wild.
How severe is CVE-2026-40525?: Critical severity, with a CVSS score of 9.1, published 17 April 2026.
Which products and versions are affected?: openviking (PyPI) < 0.3.9, ECOSYSTEM:introduced=0,fixed=0.3.9.
Is there a fix for CVE-2026-40525?: Yes. openviking (PyPI): upgrade to 0.3.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40525 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-40525?: Check whether you run openviking (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

openviking (PyPI): upgrade to 0.3.9 or later
```
pip install "openviking>=0.3.9"
```

Technical details

An authentication bypass vulnerability exists in OpenViking's VikingBot OpenAPI HTTP route surface due to a 'fail-open' condition. When the `api_key` or per-channel API key configuration values are unset or empty, the authentication middleware fails to enforce security checks on privileged endpoints such as `/bot/v1/chat`, `/bot/v1/sessions`, and `/bot/v1/chat/channel`. A remote, unauthenticated attacker can send requests to these endpoints without a valid `X-API-Key` header to submit prompts, manage bot sessions, and access integrated secrets or downstream tools. The vulnerability is addressed in version 0.3.9 by ensuring these routes return a 503 error unless an explicit API key is configured.

Affected products

volcengine OpenViking prior to 0.3.9

Identifiers

CVE-2026-40525
GHSA-jgq2-vq69-gr6h
PYSEC-2026-438

Timeline

2026-04-14: disclosed: Pull request submitted to address the vulnerability
2026-04-16: patched: Fix merged into main branch and version 0.3.9 released
2026-04-17: advisory: CVE-2026-40525 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.