Onyx CVE-2026-85700

Exploitation requires a valid Onyx user account at any privilege level - no administrative role is needed, only successful authentication (PR:L). The vulnerable instance must have at least one custom tool configured with credentials stored in custom_headers; if no custom tools with header-based authentication are defined, there are no secrets to disclose. The Onyx backend must be network-accessible to the attacker. Exploitation is limited by: (1) requiring a valid authenticated account - unauthenticated access is not possible; (2) impact is confined to confidentiality of API credentials rather than direct system compromise or code execution; (3) SSVC flags this as non-automatable, indicating mass-scale automated exploitation is unlikely.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H) accurately reflects the exploitation scenario: any low-privileged authenticated user can extract API keys in a single HTTP GET request with no special tooling or complexity. SSVC classifies this as having a POC available but not automatable with only partial technical impact, which moderates urgency for wide-scale attack scenarios - mass scanning is unlikely and requires a valid account, so opportunistic internet-wide exploitation is constrained. However, the high confidentiality impact is substantive: leaked API credentials for upstream services such as AI providers or external data sources enable unauthorized access to those systems, potentially incurring financial costs, enabling data exfiltration, or allowing actions under the Onyx platform's identity. Even a mid-sized deployment in tczew using Onyx for internal knowledge management should treat this as urgent if any custom tool integrations use sensitive or metered API credentials, since a single insider or a compromised low-privilege account is sufficient for exploitation. EPSS data is absent from the provided intelligence. No CISA KEV listing is present, and no active exploitation is confirmed. The primary limiting factor is the requirement for a valid authenticated Onyx account.

A regular Onyx user authenticates with their standard credentials and sends an unelevated GET request to /tool to enumerate all custom tool configurations. The API response includes plaintext custom_headers fields containing administrator-configured API keys for connected third-party services such as external data repositories or AI providers. The attacker extracts those credentials and uses them directly against the upstream APIs, performing actions or accessing data under the Onyx platform's identity with no further exploitation required.