CVE-2026-34999 describes a missing authentication vulnerability in Volcengine's OpenViking product affecting versions 0.2.5 prior to 0.2.14. The issue exists in the bot proxy router, specifically at the POST /bot/v1/chat and POST /bot/v1/chat/stream endpoints. Due to the lack of authentication checks, remote attackers can send requests to these endpoints and gain unauthorized access to protected bot proxy functionality, effectively interacting with the upstream bot backend without providing valid credentials. This vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function).

Remote unauthenticated attackers can bypass authentication controls and access protected bot proxy functions, potentially allowing unauthorized interaction with the upstream bot backend. This could lead to unauthorized use or manipulation of bot services. The CVSS score of 6.9 reflects a medium severity impact with network attack vector, no privileges required, and no user interaction needed.

No official patch or fix is currently documented for this vulnerability. Users should check the vendor's advisory for updates and apply any official fixes once available. Until then, restrict network access to the affected endpoints or implement external authentication controls to mitigate unauthorized access.