CVE-2026-22680: OpenViking Auth Bypass Vulnerability

CVE-2026-22680 Overview

OpenViking versions prior to 0.3.3 contain a missing authorization vulnerability (CWE-862) in the task polling endpoints that allows unauthorized attackers to enumerate or retrieve background task metadata created by other users. Attackers can access the /api/v1/tasks and /api/v1/tasks/{task_id} routes without authentication to expose task type, task status, resource identifiers, archive URIs, result payloads, and error information, potentially causing cross-tenant interference in multi-tenant deployments.

Critical Impact
Unauthorized access to background task metadata enables attackers to enumerate sensitive resource identifiers, archive URIs, and result payloads across tenant boundaries, creating significant data exposure risks in multi-tenant environments.

Affected Products

OpenViking versions prior to 0.3.3

Discovery Timeline

2026-04-07 - CVE CVE-2026-22680 published to NVD
2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-22680

Vulnerability Analysis

This vulnerability stems from a fundamental authorization flaw in OpenViking's task polling API endpoints. The affected endpoints /api/v1/tasks and /api/v1/tasks/{task_id} lacked proper ownership validation, allowing any user—including unauthenticated attackers—to query and retrieve background task information belonging to other users or tenants.

In multi-tenant deployments, this creates a serious cross-tenant data leakage scenario where an attacker can systematically enumerate task IDs and harvest sensitive metadata including task types, execution status, resource identifiers, archive URIs, result payloads, and error information. The network-accessible nature of the vulnerability requires no user interaction or special privileges to exploit.

Root Cause

The root cause is a missing authorization check (CWE-862) in the task retrieval functions. The get_task() method and related task tracking functions did not verify that the requesting user had ownership of the task being queried. The original implementation passed task IDs directly to the backend service without validating the current user's context or account association.

Attack Vector

The attack vector is network-based and requires no authentication. An attacker can directly query the task API endpoints:

Access /api/v1/tasks to enumerate all background tasks in the system
Query /api/v1/tasks/{task_id} with discovered or guessed task IDs to retrieve detailed task metadata
Extract sensitive information including resource identifiers, archive URIs, and result payloads belonging to other users

The following patch demonstrates the security fix that adds ownership validation:

python

async def get_task(self, task_id: str) -> Optional[Dict[str, Any]]:
    """Query background task status."""
-   return await self._service.sessions.get_commit_task(task_id)
+   return await self._service.sessions.get_commit_task(task_id, self._ctx)

Source: GitHub Commit Reference

Additionally, the task tracking logic was updated to include ownership verification:

python

if request.wait:
    # Synchronous path: block until reindex completes
-   if tracker.has_running(REINDEX_TASK_TYPE, uri):
+   if tracker.has_running(
+       REINDEX_TASK_TYPE,
+       uri,
+       owner_account_id=_ctx.account_id,
+       owner_user_id=_ctx.user.user_id,
+   ):
        return Response(
            status="error",
            error=ErrorInfo(

Source: GitHub Commit Reference

Detection Methods for CVE-2026-22680

Indicators of Compromise

Unusual volume of requests to /api/v1/tasks or /api/v1/tasks/{task_id} endpoints from unauthenticated sources
Sequential or enumeration-pattern requests to task endpoints with incrementing or randomized task IDs
API access logs showing cross-tenant task queries where the requesting user differs from the task owner
Error responses or access attempts for task IDs outside a user's ownership scope

Detection Strategies

Implement API request logging and monitoring for the /api/v1/tasks endpoints to identify suspicious enumeration patterns
Deploy web application firewall (WAF) rules to detect and block rapid sequential requests to task endpoints
Enable audit logging that captures both the requesting identity and the task ownership details for correlation analysis
Monitor for unauthenticated API access attempts that should require authentication

Monitoring Recommendations

Configure alerting for high-frequency requests to task polling endpoints from single IP addresses or user agents
Implement anomaly detection for API access patterns that deviate from normal user behavior baselines
Review historical access logs for evidence of past exploitation attempts against task endpoints
Establish baseline metrics for legitimate task API usage to identify deviations

How to Mitigate CVE-2026-22680

Immediate Actions Required

Upgrade OpenViking to version 0.3.3 or later immediately
If immediate upgrade is not possible, restrict network access to task API endpoints using firewall rules or reverse proxy configurations
Audit existing API access logs to identify any potential past exploitation of the vulnerability
Review multi-tenant deployments for evidence of cross-tenant data exposure

Patch Information

The vulnerability has been addressed in OpenViking version 0.3.3. The fix adds proper ownership validation by passing the user context (self._ctx) to task retrieval functions and implementing owner_account_id and owner_user_id parameters in task tracking logic.

Patch resources:

Workarounds

Implement network-level access controls to restrict access to /api/v1/tasks endpoints to trusted internal networks only
Deploy a reverse proxy or API gateway to enforce authentication on task endpoints before requests reach OpenViking
Configure rate limiting on task API endpoints to mitigate enumeration attacks
Temporarily disable public access to task polling functionality if not business-critical

bash

# Example nginx configuration to restrict task API access
location /api/v1/tasks {
    # Restrict to internal network only
    allow 10.0.0.0/8;
    allow 172.16.0.0/12;
    allow 192.168.0.0/16;
    deny all;
    
    # Add rate limiting
    limit_req zone=api_limit burst=10 nodelay;
    
    proxy_pass http://openviking_backend;
}