{"id":"CVE-2026-22680","aliases":["GHSA-h336-2wxm-pr6q","PYSEC-2026-2855"],"title":"OpenViking contains a missing authorization vulnerability in the task polling endpoints","summary":"OpenViking contains a missing authorization vulnerability in the task polling endpoints","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","vendor":"openviking","product":"openviking","ecosystem":"pip","affected":["openviking < 0.3.3"],"patched":["openviking 0.3.3"],"published":"2026-04-07","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:12.371881223Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-h336-2wxm-pr6q","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22680"},{"url":"https://github.com/volcengine/OpenViking/pull/1182"},{"url":"https://github.com/volcengine/OpenViking/commit/8c1c3f3608364ee0bb0e45f73478771a68aebdf5"},{"url":"https://github.com/volcengine/OpenViking"},{"url":"https://github.com/volcengine/OpenViking/releases/tag/v0.3.3"},{"url":"https://www.vulncheck.com/advisories/openviking-missing-authorization-via-task-polling"}],"tags":["osv","pip"],"epss":0.00384,"epssPercentile":0.3237,"ingestedAt":"2026-07-13T18:57:58.722Z","slug":"CVE-2026-22680","body":"## Overview\n\nOpenViking versions prior to 0.3.3 contain a missing authorization vulnerability in the task polling endpoints that allows unauthorized attackers to enumerate or retrieve background task metadata created by other users. Attackers can access the /api/v1/tasks and /api/v1/tasks/{task_id} routes without authentication to expose task type, task status, resource identifiers, archive URIs, result payloads, and error information, potentially causing cross-tenant interference in multi-tenant deployments.\n\n## Affected packages\n\n- `openviking < 0.3.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `openviking 0.3.3`","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}