Skip to content
OpenAdvisories

Vendor

onyx-dot-app

6 known vulnerabilities.

onyx-dot-app at a glance

Last 12 months
6
Critical · all time
1
Exploited · all time
0
Public exploit · all time
1
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 2 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 2 vulnerabilities, 1 critical September 2026: 1 vulnerability Sep October 2026: 1 vulnerability November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202610
Sep 202610
Aug 202621
Jul 202600
Jun 202600
May 202620
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

onyx 6
All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • Low 3.5
    CVE-2026-116004 Public exploit

    onyx-dot-app Onyx PreviewTab.tsx cross site scripting

    A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0. Impacted is an unknown function of the file web/src/app/craft/components/output-panel/PreviewTab.tsx. The manipulation leads to cross site scripting. The attack can be initiated remo…

    onyx-dot-app onyx
  • Medium 6.5
    CVE-2026-85700

    Onyx 4.6.6 Custom Tool Secret Header Disclosure via Tool Endpoints

    Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in custom_headers, allowing any authenticated user to read admin-defined API keys. Attackers with basic authentication can call GET /tool/{tool_id} or GET /tool endpoints to retrie…

    onyx-dot-app onyx
  • Medium 6.5
    CVE-2026-63178

    Onyx Curator-scope IDOR: any curator can modify membership of arbitrary user groups via unscoped PATCH /manage/admin/user-group/{id} and /add-users leading to cross-group document disclosure

    Onyx is an open-source AI platform. Prior to 4.3.0, Onyx Enterprise Edition's PATCH /manage/admin/user-group/{user_group_id} and POST /manage/admin/user-group/{user_group_id}/add-users endpoints in ee/onyx/server/user_group/api.py call update_user_group and a…

    onyx-dot-app onyx
  • Critical 9.6
    CVE-2026-71424

    Onyx: Cross-user OAuth-token leak via /api/mcp/servers* for per-user MCP servers

    Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.set_tokens and OnyxTokenStora…

    onyx-dot-app onyx
  • Medium 6.5
    CVE-2026-42277

    Onyx: IDOR in /chat/file/{file_id} allows any authenticated user to download other users files

    Onyx is an open-source AI platform. Prior to versions 3.0.9, 3.1.6, and 3.2.6, the GET /chat/file/{file_id} endpoint allows any authenticated user to download any other user's uploaded files by providing the file UUID. The endpoint verifies the caller is auth…

    onyx-dot-app onyx
  • Medium 4.3
    CVE-2026-42276

    Onyx: IDOR in /chat/stop-chat-session allows any authenticated user to interrupt other users chat sessions

    Onyx is an open-source AI platform. Prior to versions 3.0.9, 3.1.6, and 3.2.6, the POST /chat/stop-chat-session/{chat_session_id} endpoint lets any authenticated user stop any other user's active chat session. The endpoint checks authentication but never veri…

    onyx-dot-app onyx