OAuth Header Exposure in Onyx AI Platform Versions
CVE-2026-71424
9.6CRITICAL
What is CVE-2026-71424?
The Onyx AI platform has a significant vulnerability affecting its API endpoints, specifically GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id}. Prior versions of the platform (prior to 3.1.10, 3.2.14, and 4.0.0) inadvertently exposed OAuth Authorization headers, which can potentially allow unauthorized access to another user's tokens. This security flaw results from the sharing of per-user tokens within the admin MCPConnectionConfig row due to misconfigurations in backend token storage mechanisms. It is crucial to upgrade to the latest versions listed to mitigate the risks associated with this vulnerability.
Affected Version(s)
onyx < 3.1.10 < 3.1.10
onyx >= 3.2.0, < 3.2.14 < 3.2.0, 3.2.14
onyx >= 3.3.0-beta.0, < 4.0.0 < 3.3.0-beta.0, 4.0.0