Skip to content
OpenAdvisories

Vendor

onyx-dot-app

6 known vulnerabilities.

Products

onyx 6
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.6
    CVE-2026-71424

    Onyx: Cross-user OAuth-token leak via /api/mcp/servers* for per-user MCP servers

    Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.set_tokens and OnyxTokenStora…

    onyx-dot-app onyx