Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-75480

OpenViking Debug Vector Endpoints Multi-tenant Data Exposure

CVSS 4.0 7.1 HIGHCVSS 3.1 6.5 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-75480

Published

OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read all co-tenant records. Attackers can query these endpoints to retrieve private memories, resources, skills, and secret material belonging to other users in the same account without administrative privileges.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-75480

Published

OpenViking

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "volcengine",
                    "product": "OpenViking",
                    "defaultStatus": "unaffected",
                    "packageURL": "pkg:pypi/openviking",
                    "repo": "https://github.com/volcengine/OpenViking",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "lessThanOrEqual": "0.4.14",
                            "versionType": "custom"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON