OpenViking に root_api_key が存在しない場合、匿名 ROOT アクセスが可能

The impact of this vulnerability is severe. An attacker can exploit it to gain complete control over the OpenViking instance, effectively achieving root-level access. This allows them to perform any action the root user can, including modifying system files, installing malicious software, accessing sensitive data, and potentially pivoting to other systems on the network. The lack of authentication requirements makes this vulnerability particularly dangerous, as an attacker does not need any credentials to exploit it. The ability to manage accounts, resources, and system configurations without authentication represents a significant security risk.

Organizations deploying OpenViking in production environments, particularly those with legacy configurations or shared hosting setups, are at significant risk. Systems where the rootapikey configuration has been overlooked or improperly secured are especially vulnerable. Any environment relying on OpenViking for critical operations should prioritize patching.

• linux / server:

journalctl -u openviking | grep -i "unauthorized access"

• linux / server:

ps aux | grep -i "openviking" | grep -i "root"

• linux / server:

find /etc/openviking -name 'root_api_key' -print

1. 2026-02-26Disclosure

   disclosure

1. 予約済み2026-01-06
2. 公開日2026-02-26
3. 更新日2026-04-07
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2026-22207 is to immediately upgrade OpenViking to version 0.1.19 or later. If upgrading is not immediately feasible, a temporary workaround is to ensure the rootapikey configuration is always set and properly secured. This key should be a strong, randomly generated value and stored securely. Consider implementing stricter network segmentation to limit the potential blast radius if the system is compromised. Monitor access logs for suspicious activity, particularly requests to administrative endpoints without proper authentication.