CVE-2026-22681

🗓️ 21 Aug 2026 16:13:07Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 48 Views🌐 WEB

SSRF in OpenViking before 0.3.4 via resources API enables access to internal network services.

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2026-22681	21 Aug 202618:01	–	circl
Cvelist	CVE-2026-22681 OpenViking < 0.3.4 SSRF via /api/v1/resources	21 Aug 202616:13	–	cvelist
EUVD	EUVD-2026-63999	21 Aug 202616:13	–	euvd
Mend	CVE-2026-22681	21 Aug 202616:13	–	mend
NVD	CVE-2026-22681	21 Aug 202616:17	–	nvd
Positive Technologies	PT-2026-79394	21 Aug 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-22681: Server-Side Request Forgery (SSRF)	21 Aug 202600:00	–	rapid7
Vulnrichment	CVE-2026-22681 OpenViking < 0.3.4 SSRF via /api/v1/resources	21 Aug 202616:13	–	vulnrichment

Vulners

CNA

Node

volcengine openvikingRange0–0.3.4

[
  {
    "vendor": "Volcengine",
    "product": "OpenViking",
    "repo": "https://github.com/volcengine/OpenViking",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "0.3.4",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected",
    "packageURL": "pkg:github/volcengine/OpenViking"
  }
]

Source	Link
github	www.github.com/volcengine/OpenViking/releases/tag/v0.3.4
vulncheck	www.vulncheck.com/advisories/openviking-ssrf-via-api-v1-resources
github	www.github.com/volcengine/OpenViking/commit/41e345896d247e43ab78bbcb38b4a5b1b38ef62c
github	www.github.com/volcengine/OpenViking/pull/1133
github	www.github.com/volcengine/OpenViking/pull/1133https://github.com/volcengine/OpenViking/pull/1133

Parameter	Position	Path	Description	CWE
url	request body	/api/v1/resources	Authenticated low-privilege attackers can submit arbitrary URLs to the resources API endpoint, causing the server to issue outbound HEAD and GET requests (SSRF).	CWE-918

15 Oct 2026 19:10Current

6Medium risk

Vulners AI Score6

CVSS 48.3

CVSS 3.18.5

EPSS0.00342

SSVC

CWE-918