OpenViking vulnerabilities
CVEs whose affected-version data names the OpenViking package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
CVE-2026-75480Medium· 6.5OpenViking Debug Vector Endpoints Multi-tenant Data Exposure
OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read all co-tenant records. Attackers can query these endpoints to retrieve private m…
▾ Sunlitvolcengine · OpenVikingEPSS 0.24%via CVEORG
CVE-2026-40525Critical· 9.1OpenViking: Unauthenticated remote bot control via OpenAPI HTTP routes
OpenViking: Unauthenticated remote bot control via OpenAPI HTTP routes
▾ Midnightopenviking · openvikingEPSS 0.57%via OSV
CVE-2026-22680Medium· 5.3OpenViking contains a missing authorization vulnerability in the task polling endpoints
OpenViking contains a missing authorization vulnerability in the task polling endpoints
▾ Sunlitopenviking · openvikingEPSS 0.38%via OSV
CVE-2026-28518High· 7.8OpenViking contains a Path Traversal vulnerability
OpenViking contains a Path Traversal vulnerability
▾ Twilightopenviking · openvikingEPSS 0.18%via OSV