Log in Start free

Vulnerability · Published Jun 28, 2026 · Assigned by VulDB

CVE-2026-13507volcengine OpenViking Local VectorDB Primary-key Label str_to_uint64.py str_to_uint64 data authenticity

Medium 5.0

In plain English

A medium-severity insufficient verification of data authenticity in OpenViking from volcengine. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)5.0Medium
Exploit odds (30 days)0.2%top 92.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in volcengine OpenViking up to 0.3.21. This affects the function str_to_uint64 of the file openviking/storage/vectordb/utils/str_to_uint64.py of the component Local VectorDB Primary-key Label Handler. The manipulation of the argument ID results in insufficient verification of data authenticity. The attack may be launched remotely. Attacks of this nature are highly complex. The exploitability is reported as difficult. The pull request to fix this issue awaits acceptance.

Affected products (as reported)

VendorProductVersions
volcengine OpenViking 0.3.00.3.10.3.20.3.30.3.40.3.50.3.60.3.7

Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R

References