Access Control Flaw in Onyx 4.6.6 Exposes API Keys to Authenticated Users

CVE-2026-85700

What is CVE-2026-85700?

Onyx version 4.6.6 contains a significant access control vulnerability that permits any authenticated user to access sensitive custom tool credentials stored in custom headers. This flaw allows unauthorized individuals to make GET requests to specific tool endpoints, exposing plaintext authorization headers and third-party API credentials. With these credentials in hand, attackers can gain unauthorized access to upstream APIs, potentially leading to data breaches and other security incidents. Organizations utilizing Onyx 4.6.6 should take immediate action to remediate this vulnerability.

References