Onyx Dot App
Monthly
Credential disclosure in Onyx 4.6.6 allows any authenticated user to retrieve plaintext API keys and authorization headers that administrators configured for custom tool integrations. By calling GET /tool or GET /tool/{tool_id} with standard user credentials, an attacker can read admin-defined third-party API keys stored in custom_headers fields without any privilege escalation. A proof-of-concept exists per SSVC classification, and the stolen credentials can be leveraged to directly access upstream APIs the Onyx instance is connected to, entirely outside the platform's audit trail.
Cross-user credential disclosure in Onyx (open-source AI platform) lets any low-privileged BASIC_ACCESS user retrieve another user's OAuth Authorization header via the GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} MCP endpoints. Per-user OAuth tokens were incorrectly persisted into a shared admin MCPConnectionConfig row and then echoed back through auth_template.headers to unrelated callers, leaking bearer tokens for downstream MCP services. Affects versions prior to 3.1.10, 3.2.14, and 4.0.0; no public exploit identified at time of analysis and it is not listed in CISA KEV, but a vendor patch and detailed fix commits are available.
Privilege escalation in Onyx Enterprise Edition (versions prior to 4.3.0) allows any authenticated curator to modify user groups outside their assigned scope, gaining unauthorized document access through the platform's OpenSearch access_control_list filter. The PATCH /manage/admin/user-group/{user_group_id} and POST /manage/admin/user-group/{user_group_id}/add-users endpoints relied solely on a role check confirming the caller held curator status somewhere in the system, but the underlying database functions update_user_group and add_users_to_user_group never invoked _validate_curator_can_modify_group to scope that access to specific groups. No public exploit has been identified at time of analysis, and the issue is fixed in the vendor-released version 4.3.0.
Onyx versions prior to 3.0.9, 3.1.6, and 3.2.6 expose an authorization bypass in the GET /chat/file/{file_id} endpoint that permits authenticated users to download any other user's files by directly accessing file UUIDs. The endpoint enforces authentication but lacks per-file ownership validation, allowing attackers with valid credentials to exfiltrate confidential documents and chat attachments belonging to other users system-wide. No public exploit code or active exploitation has been identified at time of analysis.
Onyx versions before 3.0.9, 3.1.6, and 3.2.6 permit authenticated users to terminate any other user's active chat session via the POST /chat/stop-chat-session/{chat_session_id} endpoint without verifying session ownership. An attacker with valid credentials can interrupt another user's LLM generation mid-stream by supplying a known session UUID, causing denial of service to targeted chat sessions. Vendor-released patches are available, and no public exploit code or active exploitation has been identified at time of analysis.
Credential disclosure in Onyx 4.6.6 allows any authenticated user to retrieve plaintext API keys and authorization headers that administrators configured for custom tool integrations. By calling GET /tool or GET /tool/{tool_id} with standard user credentials, an attacker can read admin-defined third-party API keys stored in custom_headers fields without any privilege escalation. A proof-of-concept exists per SSVC classification, and the stolen credentials can be leveraged to directly access upstream APIs the Onyx instance is connected to, entirely outside the platform's audit trail.
Cross-user credential disclosure in Onyx (open-source AI platform) lets any low-privileged BASIC_ACCESS user retrieve another user's OAuth Authorization header via the GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} MCP endpoints. Per-user OAuth tokens were incorrectly persisted into a shared admin MCPConnectionConfig row and then echoed back through auth_template.headers to unrelated callers, leaking bearer tokens for downstream MCP services. Affects versions prior to 3.1.10, 3.2.14, and 4.0.0; no public exploit identified at time of analysis and it is not listed in CISA KEV, but a vendor patch and detailed fix commits are available.
Privilege escalation in Onyx Enterprise Edition (versions prior to 4.3.0) allows any authenticated curator to modify user groups outside their assigned scope, gaining unauthorized document access through the platform's OpenSearch access_control_list filter. The PATCH /manage/admin/user-group/{user_group_id} and POST /manage/admin/user-group/{user_group_id}/add-users endpoints relied solely on a role check confirming the caller held curator status somewhere in the system, but the underlying database functions update_user_group and add_users_to_user_group never invoked _validate_curator_can_modify_group to scope that access to specific groups. No public exploit has been identified at time of analysis, and the issue is fixed in the vendor-released version 4.3.0.
Onyx versions prior to 3.0.9, 3.1.6, and 3.2.6 expose an authorization bypass in the GET /chat/file/{file_id} endpoint that permits authenticated users to download any other user's files by directly accessing file UUIDs. The endpoint enforces authentication but lacks per-file ownership validation, allowing attackers with valid credentials to exfiltrate confidential documents and chat attachments belonging to other users system-wide. No public exploit code or active exploitation has been identified at time of analysis.
Onyx versions before 3.0.9, 3.1.6, and 3.2.6 permit authenticated users to terminate any other user's active chat session via the POST /chat/stop-chat-session/{chat_session_id} endpoint without verifying session ownership. An attacker with valid credentials can interrupt another user's LLM generation mid-stream by supplying a known session UUID, causing denial of service to targeted chat sessions. Vendor-released patches are available, and no public exploit code or active exploitation has been identified at time of analysis.