CVE-2026-22207
Published: 26 February 2026
Description
OpenViking through version 0.1.18, prior to commit 0251c70, contains a broken access control vulnerability that allows unauthenticated attackers to gain ROOT privileges when the root_api_key configuration is omitted. Attackers can send requests to protected endpoints without authentication headers to access…
more
administrative functions including account management, resource operations, and system configuration.
Mitigating Controls (NIST 800-53 r5)AI
AC-3 requires enforcement of approved authorizations for access to system resources, directly addressing the failure to enforce authentication on protected endpoints.
AC-14 mandates identification and restriction of actions permitted without identification or authentication, preventing administrative functions from being accessible unauthenticated.
AC-6 enforces least privilege to limit access to only necessary privileges, mitigating the impact of unauthorized root privilege escalation even if authentication is bypassed.
Security SummaryAI
CVE-2026-22207 is a broken access control vulnerability (CWE-306) affecting OpenViking through version 0.1.18, prior to commit 0251c7045b3f8092c4d2e1565115b1ba23db282f. The issue arises when the root_api_key configuration is omitted, enabling unauthenticated attackers to bypass authentication and access protected endpoints. This flaw has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for high confidentiality, integrity, and availability impacts.
Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no privileges required. By sending requests to protected endpoints without authentication headers, they can gain root privileges and perform administrative functions, including account management, resource operations, and system configuration.
Mitigation involves updating to the fixed commit 0251c7045b3f8092c4d2e1565115b1ba23db282f or later, as detailed in the project's GitHub repository. The vulnerability was reported in issue #302 and addressed via pull request #310. Additional guidance is available in the VulnCheck advisory at https://www.vulncheck.com/advisories/openviking-missing-root-api-key-allows-anonymous-root-access.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated remote attackers to bypass authentication and gain root privileges via protected API endpoints in a network-accessible service, directly enabling exploitation of a public-facing application.