CVE-2026-22207
Published: 26 February 2026
Summary
CVE-2026-22207 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2026-22207 is a broken access control vulnerability (CWE-306) affecting OpenViking through version 0.1.18, prior to commit 0251c7045b3f8092c4d2e1565115b1ba23db282f. The issue arises when the root_api_key configuration is omitted, enabling unauthenticated attackers to bypass authentication and access protected endpoints. This flaw has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for high confidentiality, integrity, and availability impacts.
Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no privileges required. By sending requests to protected endpoints without authentication headers, they can gain root privileges and perform administrative functions, including account management, resource operations, and system configuration.
Mitigation involves updating to the fixed commit 0251c7045b3f8092c4d2e1565115b1ba23db282f or later, as detailed in the project's GitHub repository. The vulnerability was reported in issue #302 and addressed via pull request #310. Additional guidance is available in the VulnCheck advisory at https://www.vulncheck.com/advisories/openviking-missing-root-api-key-allows-anonymous-root-access.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8885
Vulnerability details
OpenViking through version 0.1.18, prior to commit 0251c70, contains a broken access control vulnerability that allows unauthenticated attackers to gain ROOT privileges when the root_api_key configuration is omitted. Attackers can send requests to protected endpoints without authentication headers to access…
more
administrative functions including account management, resource operations, and system configuration.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated remote attackers to bypass authentication and gain root privileges via protected API endpoints in a network-accessible service, directly enabling exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 requires enforcement of approved authorizations for access to system resources, directly addressing the failure to enforce authentication on protected endpoints.
AC-14 mandates identification and restriction of actions permitted without identification or authentication, preventing administrative functions from being accessible unauthenticated.
AC-6 enforces least privilege to limit access to only necessary privileges, mitigating the impact of unauthorized root privilege escalation even if authentication is bypassed.