Volcengine vulnerabilities
We track 4 vulnerabilities in Volcengine products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on August 21, 2026.
Latest Volcengine vulnerabilities
- 8.5 High severity
OpenViking: Server-Side Request Forgery
OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the resources API endpoint. Attackers can POST a crafted URL to /
- 9.1 Critical severity
OpenViking: Not Failing Securely
OpenViking prior to version 0.3.9 contains an authentication bypass vulnerability in the VikingBot OpenAPI HTTP route surface where the authentication check fails open when the api_key configuration value is unset or empty. Remote attackers with network access
- 7.8 High severity
OpenViking: Improper Limitation of a Pathname to a Restricted Directory
OpenViking versions 0.2.1 and prior, fixed in commit 46b3e76, contain a path traversal vulnerability in the .ovpack import handling that allows attackers to write files outside the intended import directory. Attackers can craft malicious ZIP archives with trav
- 9.8 Critical severity
OpenViking: Missing Authentication for Critical Functionality
OpenViking through version 0.1.18, prior to commit 0251c70, contains a broken access control vulnerability that allows unauthenticated attackers to gain ROOT privileges when the root_api_key configuration is omitted. Attackers can send requests to protected en