CVE-2026-22680 describes a missing authorization vulnerability (CWE-862) in Volcengine's OpenViking product versions before 0.3.3. The vulnerability affects the /api/v1/tasks and /api/v1/tasks/{task_id} endpoints, which do not require authentication, allowing attackers to enumerate or retrieve background task metadata belonging to other users. This unauthorized access exposes sensitive task-related information, potentially enabling cross-tenant data leakage or interference in multi-tenant deployments. The CVSS 4.0 base score is 6.9, indicating a medium severity level. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

Unauthorized attackers can access detailed metadata about background tasks created by other users, including task type, status, resource identifiers, archive URIs, result payloads, and error information. This exposure can lead to cross-tenant interference in multi-tenant deployments, potentially compromising tenant isolation and confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API endpoints through network controls or authentication proxies to prevent unauthorized access.