OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by submitting arbitrary URLs to the resources API endpoint. Attackers can POST a crafted URL to /api/v1/resources, causing the server to issue outbound HEAD and GET requests with redirects enabled to loopback, RFC 1918, link-local, or cloud metadata addresses, then read back responses through normal content APIs to enumerate and interact with internal services.

OpenViking versions before 0.3.4 contain a server-side request forgery (SSRF) vulnerability in the resources API endpoint. Authenticated low-privilege attackers can exploit this by submitting arbitrary URLs via POST requests to /api/v1/resources. The server then issues outbound HEAD and GET requests with redirects enabled to internal addresses including loopback, RFC 1918, link-local, and cloud metadata addresses. Attackers can subsequently read back responses through normal content APIs to enumerate and interact with internal network services. The vulnerability has been patched in version 0.3.4 of OpenViking. A fix was committed and a pull request merged to address the issue. Users are advised to upgrade to v0.3.4 or later immediately.