CVE-2026-40525
Critical · CVSS 9.1OpenViking — Authentication bypass via empty/unset API key check failing open
- CVSS
- 9.1
- nvd
- EPSS
- —
- KEV
- No
- Class
- oss containerizable
- CWE-636
Description
OpenViking prior to version 0.3.9 contains an authentication bypass vulnerability in the VikingBot OpenAPI HTTP route surface where the authentication check fails open when the api_key configuration value is unset or empty. Remote attackers with network access to the exposed service can invoke privileged bot-control functionality without providing a valid X-API-Key header, including submitting attacker-controlled prompts, creating or using bot sessions, and accessing downstream tools, integrations, secrets, or data accessible to the bot.
Search profile — drives PoC discovery
Symbols VikingBotapi_keyX-API-Keyopenapibot-controlVikingBot OpenAPI HTTP route
Keywords CVE-2026-40525OpenVikingauthentication bypassVikingBotapi_keyX-API-Keyopenviking auth bypassPyPI openvikingvolcengine OpenVikingCWE-636
Versions: < 0.3.9
Affected packages
| PyPI | openviking | 0 → 0.3.9 |
References
Status: enriched · ingested 2026-07-15T00:00:20.000Z · profiled 2026-07-15T00:30:20.000Z