CVE-2026-13507
Last modified
CVE-2026-13507 is a medium-severity vulnerability rated 5/10 on the CVSS scale. A vulnerability was detected in volcengine OpenViking up to 0.3.21. This affects the function str_to_uint64 of the file openviking/storage/vectordb/utils/str_to_uint64.py of the component Local VectorDB Primary-key Label Handler. EPSS estimates a 0.14% chance of exploitation in the next 30 days.
Description
A vulnerability was detected in volcengine OpenViking up to 0.3.21. This affects the function str_to_uint64 of the file openviking/storage/vectordb/utils/str_to_uint64.py of the component Local VectorDB Primary-key Label Handler. The manipulation of the argument ID results in insufficient verification of data authenticity. The attack may be launched remotely. Attacks of this nature are highly complex. The exploitability is reported as difficult. The pull request to fix this issue awaits acceptance.
Metrics
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| volcengine | OpenViking | 0.3.0; 0.3.1; 0.3.2; 0.3.3; 0.3.4; 0.3.5; 0.3.6; 0.3.7; 0.3.8; 0.3.9; 0.3.10; 0.3.11; 0.3.12; 0.3.13; 0.3.14; 0.3.15; 0.3.16; 0.3.17; 0.3.18; 0.3.19; 0.3.20; 0.3.21 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-13507?
How severe is CVE-2026-13507?
How do I fix CVE-2026-13507?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-13501A security vulnerability has been detected in antlr ANTLR4 u…5.3
- CVE-2026-13502A flaw has been found in antlr ANTLR4 up to 4.13.2. This aff…4.5
- CVE-2026-13503A vulnerability was detected in antlr ANTLR4 up to 4.13.2. A…5.5
- CVE-2026-13504A vulnerability has been found in code-projects Project Mana…3.5
- CVE-2026-13505In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2…8.7
- CVE-2026-13506In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence f…7.5
- CVE-2026-13508A flaw has been found in khoj-ai khoj up to 2.0.0-beta.28. T…5.5
- CVE-2026-13509A vulnerability has been found in RAGapp up to 0.1.5. Affect…6.3
- CVE-2026-13510A vulnerability was found in SimStudioAI sim up to 0.6.92. A…3.7
- CVE-2026-13511A vulnerability was determined in VoltAgent up to 2.1.17. Af…3.1
- CVE-2026-13512A vulnerability was identified in Databend up to 1.2.881 on …6.3
- CVE-2026-13513A security flaw has been discovered in MyScale MyScaleDB up …5
Are you affected by CVE-2026-13507?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST