CVE-2026-22681: OpenViking SSRF Vulnerability

CVE-2026-22681 Overview

CVE-2026-22681 is a Server-Side Request Forgery (SSRF) vulnerability in OpenViking versions before 0.3.4. The flaw resides in the /api/v1/resources API endpoint, which accepts arbitrary URLs from authenticated low-privilege users. The server issues outbound HEAD and GET requests with redirects enabled, then returns response content through standard content APIs. Attackers can target loopback interfaces, RFC 1918 private ranges, link-local addresses, and cloud metadata endpoints. This vulnerability is categorized under CWE-918.

Critical Impact
Authenticated attackers can enumerate internal network services, access cloud instance metadata, and read responses from services normally isolated behind the network perimeter.

Affected Products

OpenViking versions prior to 0.3.4
Volcengine OpenViking resource ingestion API (/api/v1/resources)
Deployments exposing the OpenViking server to authenticated low-privilege users

Discovery Timeline

2026-08-21 - CVE-2026-22681 published to NVD
2026-08-21 - Last updated in NVD database
v0.3.4 - Volcengine releases patched OpenViking version

Technical Details for CVE-2026-22681

Vulnerability Analysis

The vulnerability exists in OpenViking's resource ingestion pipeline. The /api/v1/resources endpoint accepts a URL parameter via HTTP POST and fetches remote content on behalf of the caller. The server performs HEAD and GET requests with redirect following enabled and no network target validation. Response bodies flow back to the caller through subsequent content APIs, giving attackers a full read primitive against internal services.

An authenticated user with minimal privileges can weaponize this behavior. Because the server followed redirects without re-validating the destination, an attacker-controlled public URL can redirect to internal targets to bypass any front-end URL filtering.

Root Cause

OpenViking did not enforce network target restrictions before initiating outbound HTTP requests. The resource fetcher accepted any syntactically valid URL and did not distinguish between public destinations and internal ranges such as 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, or cloud metadata endpoints like 169.254.169.254. The patch introduces an ensure_public_remote_target guard and threads an enforce_public_remote_targets=True flag through the resources router.

Attack Vector

The attack requires network access to the OpenViking API and valid low-privilege credentials. An attacker submits a crafted POST to /api/v1/resources referencing an internal or metadata URL. The server fetches the target, then the attacker retrieves the buffered response through the normal content APIs to enumerate internal services or exfiltrate cloud credentials.

python

# Patch: openviking/server/local_input_guard.py
 import re
 from pathlib import Path
 
+from openviking.utils.network_guard import ensure_public_remote_target
 from openviking_cli.exceptions import PermissionDeniedError
 
 _WINDOWS_DRIVE_RE = re.compile(r"^[A-Za-z]:[\\/]")

# Patch: openviking/server/routers/resources.py
             wait=request.wait,
             timeout=request.timeout,
             allow_local_path_resolution=allow_local_path_resolution,
+            enforce_public_remote_targets=True,
             **kwargs,
         ),
     )

Source: GitHub Commit 41e3458

Detection Methods for CVE-2026-22681

Indicators of Compromise

POST requests to /api/v1/resources containing URLs referencing 127.0.0.1, localhost, RFC 1918 ranges, or 169.254.169.254
OpenViking server initiating outbound HEAD or GET requests to internal addresses shortly after authenticated API calls
Unusual redirect chains in OpenViking egress logs terminating at private or link-local destinations
Repeated /api/v1/resources submissions from a single low-privilege account enumerating internal ports or hostnames

Detection Strategies

Inspect OpenViking access logs for POST bodies to /api/v1/resources and parse the submitted URL against an allowlist of expected public domains
Correlate authenticated API activity with outbound HTTP connections from the OpenViking host to non-public IP ranges
Alert on any OpenViking-originated request to cloud metadata endpoints such as 169.254.169.254, metadata.google.internal, or 100.100.100.200

Monitoring Recommendations

Enable egress network flow logging on hosts running OpenViking and route logs to a centralized detection pipeline
Instrument application logs to record the resolved target IP for each resource fetch, not just the submitted URL
Baseline the normal outbound destinations for OpenViking and alert on deviations to private, loopback, or link-local ranges

How to Mitigate CVE-2026-22681

Immediate Actions Required

Upgrade OpenViking to version 0.3.4 or later, which enforces public remote target validation by default
Rotate any cloud credentials or tokens accessible from the OpenViking host's instance metadata service
Audit /api/v1/resources request history for URLs targeting internal ranges and investigate associated accounts
Restrict which authenticated users may call the resources API until the upgrade is complete

Patch Information

The fix is delivered in OpenViking v0.3.4 via pull request #1133 and commit 41e3458. The patch adds ensure_public_remote_target in openviking/server/local_input_guard.py and enables enforce_public_remote_targets=True in the resources router. See the VulnCheck SSRF advisory for additional detail.

Workarounds

Place OpenViking behind an egress proxy that blocks connections to RFC 1918, loopback, link-local, and cloud metadata addresses
Configure host-level firewall rules to deny outbound traffic from the OpenViking process to internal ranges and 169.254.169.254
Enable IMDSv2 with hop-limit 1 on AWS instances to reduce the impact of metadata service access via SSRF
Temporarily disable or gate the /api/v1/resources endpoint at the reverse proxy for untrusted user tiers

bash

# Example egress firewall rules restricting OpenViking outbound access
iptables -A OUTPUT -m owner --uid-owner openviking -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner openviking -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner openviking -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner openviking -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner openviking -d 169.254.0.0/16 -j REJECT