CVE-2026-40525: OpenViking Unauthenticated Remote Bot Control Vulnerability
Summary
CVE-2026-40525: OpenViking: Unauthenticated remote bot control via OpenAPI HTTP routes. Affects openviking versions < 0.3.9. Fixed in 0.3.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenViking is an open-source project that provides a framework for controlling bots through an API. It allows users to create and manage bot sessions, integrate with various tools, and automate tasks. However, prior to commit c7bb167, OpenViking had a critical vulnerability that allowed unauthenticated access to its bot control functionalities, exposing sensitive operations to potential attackers.
Vulnerability Detail
The vulnerability in OpenViking arises from an authentication bypass in the VikingBot OpenAPI HTTP routes. Specifically, when the api_key configuration value is unset or empty, the authentication check fails, allowing remote attackers with network access to invoke privileged bot-control functionalities without a valid X-API-Key header. This includes the ability to submit attacker-controlled prompts, create or use bot sessions, and access sensitive integrations and data, leading to severe security risks.
How To Fix
Latest published version: 0.5.1.1 as of 23 Oct 2026
pip install --upgrade "openviking==0.5.1.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.3.9
This is the first release that contains the fix.
pip install --upgrade "openviking==0.3.9"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that the api_key configuration is set to a valid value to prevent unauthorized access. You can do this by adding the following line to your configuration file: api_key = 'your_secure_api_key'.
Conclusion
The CVE-2026-40525 vulnerability in OpenViking presents a significant security risk due to its authentication bypass, allowing unauthorized access to bot control functionalities. It is crucial to update to the patched version and configure the api_key to mitigate these risks.
See every vulnerability recorded for openviking →
FAQ
CVE-2026-40525 is a critical vulnerability in OpenViking that allows unauthenticated remote control of bots due to an authentication bypass.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The risks include unauthorized access to bot functionalities, submission of malicious prompts, and exposure of sensitive data and integrations.
The CVSS score of this vulnerability is 9.1, indicating a critical level of severity.
Ensure that you update to version 0.3.9 or later and configure the api_key properly to secure your OpenViking installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for openviking.
