Vulnerability · Published Aug 17, 2026 · Assigned by VulnCheck

CVE-2026-75480OpenViking Debug Vector Endpoints Multi-tenant Data Exposure

Medium 6.5

In plain English

A medium-severity incorrect authorization in OpenViking from volcengine. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 64.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read all co-tenant records. Attackers can query these endpoints to retrieve private memories, resources, skills, and secret material belonging to other users in the same account without administrative privileges.

Affected products (as reported)

Vendor	Product	Versions
volcengine	OpenViking	0 – through 0.4.14

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

GitHub Issue #3724 issue-tracking
https://github.com/volcengine/OpenViking product
_SingleAccountBackend in openviking/storage/viking_vector_index_backend.py technical-description
VulnCheck Advisory: OpenViking Debug Vector Endpoints Multi-tenant Data Exposure third-party-advisory