CVE-2026-22681 is a server-side request forgery vulnerability in Volcengine's OpenViking product affecting versions prior to 0.3.4. Authenticated users with low privileges can exploit this by POSTing arbitrary URLs to the /api/v1/resources API endpoint. The server then issues outbound HEAD and GET requests with redirects enabled to internal network addresses such as loopback, RFC 1918 private IPs, link-local, or cloud metadata services. The responses are returned through normal content APIs, allowing attackers to enumerate and interact with internal services that are otherwise inaccessible.

The vulnerability allows authenticated low-privilege attackers to bypass network segmentation and access internal network services, potentially exposing sensitive internal resources and metadata. This can lead to information disclosure and further internal network reconnaissance. There is no indication of remote unauthenticated exploitation or privilege escalation beyond the authenticated low-privilege user context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is indicated in the provided data, users should monitor the vendor's advisories for updates. In the meantime, restrict access to the /api/v1/resources endpoint to trusted users and consider network-level controls to limit outbound requests from the server to sensitive internal addresses.