CVE-2026-13507
volcengine OpenViking Local VectorDB Primary-key Label str_to_uint64.py str_to_uint64 data authenticity
Description
A vulnerability was detected in volcengine OpenViking up to 0.3.21. This affects the function str_to_uint64 of the file openviking/storage/vectordb/utils/str_to_uint64.py of the component Local VectorDB Primary-key Label Handler. The manipulation of the argument ID results in insufficient verification of data authenticity. The attack may be launched remotely. Attacks of this nature are highly complex. The exploitability is reported as difficult. The pull request to fix this issue awaits acceptance.
INFO
Published Date :
June 28, 2026, 9:30 p.m.
Last Modified :
June 28, 2026, 9:30 p.m.
Remotely Exploit :
No
Source :
VulDB
Solution
- Apply the pull request to fix str_to_uint64.
- Verify data authenticity checks in ID processing.
- Update OpenViking to a patched version.
- Review related ID handling logic.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-13507 vulnerability anywhere in the article.