---
id: CVE-2026-22207
title: OpenViking Missing root_api_key Allows Anonymous ROOT Access
summary: "OpenViking through version 0.1.18, prior to commit\_0251c70,\_contains a broken access control vulnerability that allows unauthenticated attackers to gain ROOT privileges when the root_api_key configuration is omitted. Attackers can send r…"
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-306
vendor: Volcengine
product: OpenViking
affected:
  - OpenViking <= 0.1.18
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-03-02T20:55:27.000105Z'
exploitAvailable: true
published: '2026-02-26'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:01:11.602Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-22207'
references:
  - url: 'https://github.com/volcengine/OpenViking/issues/302'
  - url: 'https://github.com/volcengine/OpenViking/pull/310'
  - url: >-
      https://github.com/volcengine/OpenViking/commit/0251c7045b3f8092c4d2e1565115b1ba23db282f
  - url: >-
      https://www.vulncheck.com/advisories/openviking-missing-root-api-key-allows-anonymous-root-access
tags:
  - cve.org
  - exploit-available
epss: 0.0049
epssPercentile: 0.42424
ingestedAt: '2026-11-08T14:51:22.477Z'
---

## Overview

OpenViking through version 0.1.18, prior to commit 0251c70, contains a broken access control vulnerability that allows unauthenticated attackers to gain ROOT privileges when the root_api_key configuration is omitted. Attackers can send requests to protected endpoints without authentication headers to access administrative functions including account management, resource operations, and system configuration.

## Affected

- `OpenViking <= 0.1.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.