CVE-2026-75480: OpenViking Information Disclosure Flaw

CVE-2026-75480 Overview

CVE-2026-75480 is a broken access control vulnerability [CWE-863] in OpenViking, an open-source vector index backend maintained by Volcengine. The debug vector scroll and count endpoints enforce only account-level scoping and omit user-level authorization checks. Any authenticated user in a shared account can query these endpoints to read records belonging to co-tenants in the same account. Exposed data includes private memories, resources, skills, and secret material stored in the vector index. Exploitation requires only low-privilege authenticated access and no user interaction.

Critical Impact
Authenticated low-privilege users can read all co-tenant records in a shared OpenViking account, exposing private memories, resources, skills, and secret material through the debug vector endpoints.

Affected Products

OpenViking (Volcengine) - viking_vector_index_backend component
Deployments exposing debug vector scroll endpoint to authenticated users
Deployments exposing debug vector count endpoint to authenticated users

Discovery Timeline

2026-08-17 - CVE-2026-75480 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-75480

Vulnerability Analysis

OpenViking is a vector index backend used to store embeddings and associated content for AI applications. The service supports multi-tenant deployments where multiple users share a single account context. The scroll and count debug endpoints in viking_vector_index_backend.py iterate over stored vector records to support diagnostics and administrative visibility.

The endpoints validate that the caller belongs to the account owning the target index, but they do not compare the record user_id field against the caller identity. As a result, any authenticated principal in the account receives records for every user in that account. The debug endpoints return full record payloads, including memories, resources, skills, and secret material persisted alongside the embeddings.

Root Cause

The root cause is missing authorization at the object level [CWE-863]. The implementation applies coarse-grained scoping (account) but omits fine-grained scoping (user). The debug endpoints were designed for administrative diagnostics but are reachable by non-administrative authenticated users. See the VulnCheck OpenViking Advisory and the affected viking_vector_index_backend.py source file for the underlying implementation.

Attack Vector

An attacker authenticates as any low-privilege user in a target OpenViking account. The attacker issues a request to the debug scroll endpoint to enumerate stored vector records and their metadata. The attacker repeats the request with pagination cursors to exfiltrate the full dataset. The count endpoint can be used to discover total record volume before enumeration. No administrative role, exploit chaining, or user interaction is required. Additional detail is available in GitHub Issue #3724.

Vulnerability mechanism (prose description):
1. Client authenticates with low-privilege user credentials.
2. Client calls debug scroll endpoint with target account identifier.
3. Backend validates account membership only.
4. Backend returns all records for the account regardless of owning user.
5. Client paginates until all co-tenant records are retrieved.

Detection Methods for CVE-2026-75480

Indicators of Compromise

Repeated authenticated requests to debug scroll or count endpoints in viking_vector_index_backend from non-administrative users.
Pagination cursor sequences that traverse the entire account dataset from a single low-privilege session.
Response payloads containing user_id values that do not match the requesting principal.

Detection Strategies

Log all invocations of the OpenViking debug endpoints and alert on callers whose role is not administrative.
Correlate returned record user_id fields with the authenticated caller identity and flag mismatches.
Baseline normal debug endpoint usage volume and alert on sudden increases indicative of bulk enumeration.

Monitoring Recommendations

Forward OpenViking application and access logs into a centralized analytics platform for retention and query.
Monitor egress volume from OpenViking service pods for spikes consistent with dataset exfiltration.
Track authentication events for OpenViking accounts and correlate with debug endpoint access patterns.

How to Mitigate CVE-2026-75480

Immediate Actions Required

Restrict network access to the OpenViking debug scroll and count endpoints so only administrative service accounts can reach them.
Audit historical logs for prior calls to these endpoints by non-administrative users and treat matched records as potentially exposed.
Rotate secrets, credentials, and API keys that may have been stored inside vector records in shared accounts.

Patch Information

No fixed version is listed in the NVD entry at time of publication. Track the upstream OpenViking repository and Issue #3724 for a patched release. Apply user-level authorization checks in viking_vector_index_backend.py that compare the record user_id to the authenticated caller identity before returning records.

Workarounds

Disable the debug scroll and count endpoints at the ingress or reverse proxy layer for all non-administrative principals.
Deploy each tenant into a dedicated OpenViking account to remove co-tenancy exposure until a patch is available.
Add an authorization middleware that rejects debug endpoint requests when the caller role is not explicitly administrative.

bash

# Example nginx ingress rule blocking debug endpoints from general users
location ~ ^/openviking/.*/(scroll|count)$ {
    if ($http_x_user_role != "admin") {
        return 403;
    }
    proxy_pass http://openviking_backend;
}