| Package | Affected versions | Patched versions |
|---|---|---|
| openviking | < 0.3.3 | 0.3.3 |
| openviking | < 0.3.3 | 0.3.3 |
OpenViking versions prior to 0.3.3 contain a missing authorization vulnerability in the task polling endpoints that allows unauthorized attackers to enumerate or retrieve background task metadata created by other users. Attackers can access the /api/v1/tasks and /api/v1/tasks/{task_id} routes without authentication to expose task type, task status, resource identifiers, archive URIs, result payloads, and error information, potentially causing cross-tenant interference in multi-tenant deployments.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free