Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

volcengine/openviking

              main @ e43a4c5
            

Fixes

CVEs

CRITICAL

Peak severity

31.6%

Coverage

Highlights

Denial of Service: 33 prior fixes. Scrutinize any change in this area.

openviking/storage/viking_fs.py: most-fixed (6 issues). Treat as high-risk during review.

50 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Authentication Bypass: Missing or omitted API key validation on critical bot control and proxy routing endpoints allowed unauthenticated remote command execution. This vulnerability is tracked in CVE-2026-40525.

Auth Bypass: Flaws in the mapping, scoping, and validation of user identities, shorthand namespaces, and request contexts allowed unauthorized directory writes and cross-tenant filesystem access. Access checks failed to normalize paths before evaluating access criteria.

Path Traversal: Extracting uploaded skill packs (.ovpack) and zip archives without resolving canonical file paths allowed directory traversal, enabling attackers to write arbitrary files outside the target workspace. This is tracked in CVE-2026-28518.