GitHub Advisoryadvisory · PyPI

GHSA-h336-2wxm-pr6q OpenViking contains a missing authorization vulnerability in the task polling endpoints

MEDIUM Published 2026-04-07 Modified 2026-04-08 Official page ↗
Aliases
CVE-2026-22680
Ecosystem
PyPI
Packages
OpenViking
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-862
Reviewed
2026-04-08

Affected packages

• PyPI OpenViking: < 0.3.3 → fixed in 0.3.3

Description

OpenViking versions prior to 0.3.3 contain a missing authorization vulnerability in the task polling endpoints that allows unauthorized attackers to enumerate or retrieve background task metadata created by other users. Attackers can access the /api/v1/tasks and /api/v1/tasks/{task_id} routes without authentication to expose task type, task status, resource identifiers, archive URIs, result payloads, and error information, potentially causing cross-tenant interference in multi-tenant deployments.

Related

Alias · CVE (1)

  • CVE-2026-22680 OpenViking versions prior to 0.3.3 contain a missing authorization vulnerability in the task polling endpoints that allows unauthorized… vulnerability

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References