CVE-2026-22680: OpenViking Auth Bypass Vulnerability

CVE-2026-22680 Overview

OpenViking versions prior to 0.3.3 contain a missing authorization vulnerability (CWE-862) in the task polling endpoints that allows unauthorized attackers to enumerate or retrieve background task metadata created by other users. Attackers can access the /api/v1/tasks and /api/v1/tasks/{task_id} routes without authentication to expose task type, task status, resource identifiers, archive URIs, result payloads, and error information, potentially causing cross-tenant interference in multi-tenant deployments.

Critical Impact

Unauthorized access to background task metadata enables attackers to enumerate sensitive resource identifiers, archive URIs, and result payloads across tenant boundaries, creating significant data exposure risks in multi-tenant environments.

Affected Products

• OpenViking versions prior to 0.3.3

Discovery Timeline

• 2026-04-07 - CVE CVE-2026-22680 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-22680

Vulnerability Analysis

This vulnerability stems from a fundamental authorization flaw in OpenViking's task polling API endpoints. The affected endpoints /api/v1/tasks and /api/v1/tasks/{task_id} lacked proper ownership validation, allowing any user—including unauthenticated attackers—to query and retrieve background task information belonging to other users or tenants.

In multi-tenant deployments, this creates a serious cross-tenant data leakage scenario where an attacker can systematically enumerate task IDs and harvest sensitive metadata including task types, execution status, resource identifiers, archive URIs, result payloads, and error information. The network-accessible nature of the vulnerability requires no user interaction or special privileges to exploit.

Root Cause

The root cause is a missing authorization check (CWE-862) in the task retrieval functions. The get_task() method and related task tracking functions did not verify that the requesting user had ownership of the task being queried. The original implementation passed task IDs directly to the backend service without validating the current user's context or account association.

Attack Vector

The attack vector is network-based and requires no authentication. An attacker can directly query the task API endpoints:

1. Access /api/v1/tasks to enumerate all background tasks in the system
2. Query /api/v1/tasks/{task_id} with discovered or guessed task IDs to retrieve detailed task metadata
3. Extract sensitive information including resource identifiers, archive URIs, and result payloads belonging to other users

The following patch demonstrates the security fix that adds ownership validation:

async def get_task(self, task_id: str) -> Optional[Dict[str, Any]]:
    """Query background task status."""
-   return await self._service.sessions.get_commit_task(task_id)
+   return await self._service.sessions.get_commit_task(task_id, self._ctx)

Source: GitHub Commit Reference

Additionally, the task tracking logic was updated to include ownership verification:

if request.wait:
    # Synchronous path: block until reindex completes
-   if tracker.has_running(REINDEX_TASK_TYPE, uri):
+   if tracker.has_running(
+       REINDEX_TASK_TYPE,
+       uri,
+       owner_account_id=_ctx.account_id,
+       owner_user_id=_ctx.user.user_id,
+   ):
        return Response(
            status="error",
            error=ErrorInfo(

Source: GitHub Commit Reference

Detection Methods for CVE-2026-22680

Indicators of Compromise

• Unusual volume of requests to /api/v1/tasks or /api/v1/tasks/{task_id} endpoints from unauthenticated sources
• Sequential or enumeration-pattern requests to task endpoints with incrementing or randomized task IDs
• API access logs showing cross-tenant task queries where the requesting user differs from the task owner
• Error responses or access attempts for task IDs outside a user's ownership scope

Detection Strategies

• Implement API request logging and monitoring for the /api/v1/tasks endpoints to identify suspicious enumeration patterns
• Deploy web application firewall (WAF) rules to detect and block rapid sequential requests to task endpoints
• Enable audit logging that captures both the requesting identity and the task ownership details for correlation analysis
• Monitor for unauthenticated API access attempts that should require authentication

Monitoring Recommendations

• Configure alerting for high-frequency requests to task polling endpoints from single IP addresses or user agents
• Implement anomaly detection for API access patterns that deviate from normal user behavior baselines
• Review historical access logs for evidence of past exploitation attempts against task endpoints
• Establish baseline metrics for legitimate task API usage to identify deviations

How to Mitigate CVE-2026-22680

Immediate Actions Required

• Upgrade OpenViking to version 0.3.3 or later immediately
• If immediate upgrade is not possible, restrict network access to task API endpoints using firewall rules or reverse proxy configurations
• Audit existing API access logs to identify any potential past exploitation of the vulnerability
• Review multi-tenant deployments for evidence of cross-tenant data exposure

Patch Information

The vulnerability has been addressed in OpenViking version 0.3.3. The fix adds proper ownership validation by passing the user context (self._ctx) to task retrieval functions and implementing owner_account_id and owner_user_id parameters in task tracking logic.

Patch resources:

• OpenViking Release v0.3.3
• GitHub Pull Request #1182
• Security Commit

Workarounds

• Implement network-level access controls to restrict access to /api/v1/tasks endpoints to trusted internal networks only
• Deploy a reverse proxy or API gateway to enforce authentication on task endpoints before requests reach OpenViking
• Configure rate limiting on task API endpoints to mitigate enumeration attacks
• Temporarily disable public access to task polling functionality if not business-critical

# Example nginx configuration to restrict task API access
location /api/v1/tasks {
    # Restrict to internal network only
    allow 10.0.0.0/8;
    allow 172.16.0.0/12;
    allow 192.168.0.0/16;
    deny all;
    
    # Add rate limiting
    limit_req zone=api_limit burst=10 nodelay;
    
    proxy_pass http://openviking_backend;
}