CVE-2026-34999
Full vulnerability record from the local CVENow database.
Description
OpenViking versions 0.2.5 prior to 0.2.14 contain a missing authentication vulnerability in the bot proxy router that allows remote unauthenticated attackers to access protected bot proxy functionality by sending requests to the POST /bot/v1/chat and POST /bot/v1/chat/stream endpoints. Attackers can bypass authentication checks and interact directly with the upstream bot backend through the OpenViking proxy without providing valid credentials.
Severity
MEDIUM
CVSS score
6.9
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-04-01 14:16:55.947000
Last modified
2026-10-26 22:10:00.163000
View original CVE JSON
{
"id": "CVE-2026-34999",
"sourceIdentifier": "[email protected]",
"published": "2026-04-01T14:16:55.947",
"lastModified": "2026-10-26T22:10:00.163",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenViking versions 0.2.5 prior to 0.2.14 contain a missing authentication vulnerability in the bot proxy router that allows remote unauthenticated attackers to access protected bot proxy functionality by sending requests to the POST /bot/v1/chat and POST /bot/v1/chat/stream endpoints. Attackers can bypass authentication checks and interact directly with the upstream bot backend through the OpenViking proxy without providing valid credentials."
},
{
"lang": "es",
"value": "Versiones de OpenViking 0.2.5 anteriores a la 0.2.14 contienen una vulnerabilidad de autenticación ausente en el router proxy del bot que permite a atacantes remotos no autenticados acceder a la funcionalidad protegida del proxy del bot enviando solicitudes a los endpoints POST /bot/v1/chat y POST /bot/v1/chat/stream. Los atacantes pueden eludir las comprobaciones de autenticación e interactuar directamente con el backend del bot ascendente a través del proxy de OpenViking sin proporcionar credenciales válidas."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Volcengine",
"product": "OpenViking",
"defaultStatus": "unaffected",
"repo": "https://github.com/volcengine/OpenViking",
"packageURL": "pkg:github/volcengine/OpenViking",
"versions": [
{
"version": "0.2.5",
"lessThan": "0.2.14",
"versionType": "semver",
"status": "affected"
},
{
"version": "27acda8d1701ff68423fbd6c902208e3c1ed9373",
"versionType": "git",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-01T20:26:37.161626Z",
"id": "CVE-2026-34999",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-306"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:volcengine:openviking:*:*:*:*:*:*:*:*",
"versionStartIncluding": "0.2.5",
"versionEndExcluding": "0.2.14",
"matchCriteriaId": "E557EBDE-5EC3-49C5-AC28-F34726561EC3"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/volcengine/OpenViking/commit/27acda8d1701ff68423fbd6c902208e3c1ed9373",
"source": "[email protected]",
"tags": [
"Patch"
]
},
{
"url": "https://github.com/volcengine/OpenViking/pull/996",
"source": "[email protected]",
"tags": [
"Issue Tracking"
]
},
{
"url": "https://github.com/volcengine/OpenViking/releases/tag/v0.2.14",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://www.vulncheck.com/advisories/openviking-bot-proxy-endpoints-allow-unauthenticated-access",
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
}
]
}