CVE-2026-85700
MediumCVSS 6.5Summary
Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in custom_headers, allowing any authenticated user to read admin-defined API keys. Attackers with basic authentication can call GET /tool/{tool_id} or GET /tool endpoints to retrieve plaintext authorization headers and third-party API credentials, then use them to directly access upstream APIs.
Risk Assessment
Exposure of API credentials could allow attackers to access external systems and data, potentially leading to confidentiality and integrity breaches.
Recommendation
Upgrade Onyx to a patched version and restrict access to /tool endpoints to authorized users.
Other vulnerabilities in Onyx
See all- CVE-2026-71424Critical
Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.set_tokens and OnyxTokenStorage.set_client_info in backend/onyx/server/features/mcp/api.py copy per-user tokens into a shared admin MCPConnectionConfig row and _db_mcp_server_to_api_mcp_server returns that row through auth_template.headers to any BASIC_ACCESS user. This issue is fixed in versions 3.1.10, 3.2.14, and 4.0.0.
- CVE-2026-63178Medium
Onyx is an open-source AI platform. Prior to 4.3.0, the Enterprise Edition lacks enforcement of curator permission validation in the PATCH /manage/admin/user-group/{user_group_id} and POST /manage/admin/user-group/{user_group_id}/add-users endpoints, allowing a curator to add accounts to arbitrary groups and gain document access. This is fixed in version 4.3.0.
Original NVD description (English source)
Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in custom_headers, allowing any authenticated user to read admin-defined API keys. Attackers with basic authentication can call GET /tool/{tool_id} or GET /tool endpoints to retrieve plaintext authorization headers and third-party API credentials, then use them to directly access upstream APIs.