p PatchFirst

CVE-2026-22680

CVE-2026-22680 · OpenViking < 0.3.3 Missing Authorization via Task Polling

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OpenViking versions prior to 0.3.3 contain a missing authorization vulnerability in the task polling endpoints that allows unauthorized attackers to enumerate or retrieve background task metadata created by other users. Attackers can access the /api/v1/tasks and /api/v1/tasks/{task_id} routes without authentication to expose task type, task status, resource identifiers, archive URIs, result payloads, and error information, potentially causing cross-tenant interference in multi-tenant deployments.

CVSS 6.9 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • openviking

    Versions
    • ≥ 0, < 0.3.3: Affected (semver)
    • 8c1c3f3608364ee0bb0e45f73478771a68aebdf5: Not affected (git)

    Update to 0.3.3

  • openviking PyPI

    Versions
    • 0.2.10.dev45
    • 0.2.10.dev50
    • 0.2.11
    • 0.2.12
    • 0.2.12.dev1
    • 0.2.13
    • 0.2.15
    • 0.3.1
    • 0.3.2
    Affected ranges
    • ECOSYSTEM: < 0.3.3

    Update to 0.3.3

  • openviking PyPI

    Versions
    • 0.1.17
    • 0.1.18
    • 0.2.1
    • 0.2.10
    • 0.2.10.dev45
    • 0.2.10.dev50
    • 0.2.11
    • 0.2.12
    • 0.2.12.dev1
    • 0.2.13
    • 0.2.13.dev2
    • 0.2.13.dev4
    • 0.2.14.dev4
    • 0.2.15
    • 0.2.16.dev9
    • 0.2.3
    • 0.2.5
    • 0.2.6
    • 0.3.1
    • 0.3.2
    Affected ranges
    • ECOSYSTEM: < 0.3.3

    Update to 0.3.3

Original sources

Check your server →