CVE-2026-22681: Volcengine Openviking

High severity, CVSS 8.5. EPSS: 0.3% chance of exploitation in the next 30 days.

OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the resources API endpoint. Attackers can POST a crafted URL to /api/v1/resources, causing the server to issue outbound HEAD and GET requests with redirects enabled to loopback, RFC 1918, link-local, or cloud metadata addresses, then read back responses through normal content APIs to enumerate and interact with internal services.

Affected products

• Volcengine Openviking: before 0.3.4 (fixed in 0.3.4)

Published 2026-08-21. Last modified 2026-09-24.