CVE-2026-22207 — OpenViking Missing root_api_key Allows Anonymous ROOT Access
OpenViking through version 0.1.18, prior to commit 0251c70, contains a broken access control vulnerability that allows unauthenticated attackers to gain ROOT privileges when the…
Published: 2026-02-26 · CVSS: 9.3 · CVSS 4.0
OpenViking through version 0.1.18, prior to commit 0251c70, contains a broken access control vulnerability that allows unauthenticated attackers to gain ROOT privileges when the root_api_key configuration is omitted. Attackers can send requests to protected endpoints without authentication headers to access administrative functions including account management, resource operations, and system configuration.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7