CVE-2026-22681: Server-Side Request Forgery (SSRF) in Volcengine OpenViking

CVE-2026-22681 is a server-side request forgery vulnerability in Volcengine's OpenViking product affecting versions >=0 and <0.3.4. Authenticated low-privilege attackers can exploit this by sending crafted POST requests with arbitrary URLs to the /api/v1/resources endpoint. The server then issues outbound HEAD and GET requests with redirects enabled to internal network addresses including loopback, RFC 1918 private ranges, link-local, or cloud metadata endpoints. The responses are accessible through normal content APIs, allowing attackers to enumerate and interact with internal services that are otherwise inaccessible externally.

An attacker with low-privilege authentication can leverage this SSRF vulnerability to access and interact with internal network services that should be inaccessible externally. This can lead to information disclosure about internal infrastructure and potentially further exploitation depending on the internal services exposed. The vulnerability does not require user interaction but does require authentication with low privileges.

A fix is available in OpenViking version 0.3.4. Users should upgrade to version 0.3.4 or later to remediate this vulnerability. Since this is not a cloud service, remediation depends on applying the official patch. Patch status is confirmed by the affectedVersions field indicating versions before 0.3.4 are vulnerable.