Onyx vulnerabilities

1 known vulnerability in Onyx from Onyx-dot-app. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.6 Critical severity

  onyx: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-71424Aug 17, 2026Onyx-dot-app

  Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.set_tokens and OnyxTokenStorag