CVE-2026-22207 OpenViking Missing root_api_key Allows Anonymous ROOT Access
Unauthenticated attackers can gain root privileges if the root_api_key is omitted, allowing full administrative control over the OpenViking server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-22207?
CVE-2026-22207 is a critical missing authorization vulnerability in Volcengine OpenViking, published on 26 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenViking through version 0.1.18, prior to commit 0251c70, contains a broken access control vulnerability that allows unauthenticated attackers to gain ROOT privileges when the root_api_key configuration is omitted. Attackers can send requests to protected endpoints without authentication headers to access administrative functions including account management, resource operations, and system configuration.
Weakness: CWE-306
Which versions are affected by CVE-2026-22207?
How do I fix CVE-2026-22207?
No fix has been published for CVE-2026-22207 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-22207 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-22207 exists.
Sources
Also known as GHSA-mpqv-244m-cf9r.