CVE-2026-22681: OpenViking < 0.3.4 SSRF via /api/v1/resources
OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the resources API endpoint. Attackers can POST a crafted URL to /api/v1/resources, causing the server to issue outbound HEAD and GET requests with redirects enabled to loopback, RFC 1918, link-local, or cloud metadata addresses, then read back responses through normal content APIs to enumerate and interact with internal services.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenVikingto a version that resolves this vulnerability.Fixed in 0.3.4 - Compensating control
Restrict outbound server connectivity so it cannot reach loopback (127.0.0.0/8), RFC 1918 private networks, link-local addresses, or cloud metadata IP ranges; allow only required destinations to prevent SSRF from accessing internal services via /api/v1/resources.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated attacker with low-privilege access can exploit it. They need access to submit a crafted URL to the /api/v1/resources endpoint; no user interaction is required.
What systems and data could be exposed?
The vulnerable server can be induced to send HEAD and GET requests to loopback, RFC 1918 private-network, link-local, and cloud metadata addresses. Responses can then be read through normal content APIs, allowing enumeration of and interaction with internal services reachable from the OpenViking host.
Are redirects relevant to exploitation?
Yes. Redirects are enabled for the outbound requests, so a submitted URL may redirect the server to an internal or metadata address.
What version resolves the issue?
OpenViking 0.3.4 addresses this vulnerability. Versions before 0.3.4 are affected.