CyberSecBulletin

Onyx-dot-app vulnerabilities

We track 1 vulnerability in Onyx-dot-app products. 1 is rated high or critical, and none are known to be exploited. The most recent was published on August 17, 2026.

1vulnerabilities
1critical
0high
0exploited
9.6average CVSS score

Latest Onyx-dot-app vulnerabilities

  • 9.6 Critical severity

    onyx: Exposure of Sensitive Information to an Unauthorized Actor

    CVE-2026-71424Onyx-dot-app

    Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.set_tokens and OnyxTokenStorag