Vulnerabilities

TI-2026-80125 CVE-2026-116004 · GHSA-f3f8-mxmv-8237

Cross-site scripting in onyx-dot-app Onyx PreviewTab.tsx

LOW 23

A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00199 Published 2026-10-25 No fix listed CWE-79

TI-2026-58811 CVE-2026-85700 · GHSA-jwfj-6q57-4cp3

Onyx 4.6.6 Custom Tool Secret Header Disclosure via Tool Endpoints

MEDIUM 64

Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in custom_headers, allowing any authenticated user to read admin-defined API keys.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00511 Published 2026-09-04 No fix listed CWE-522

TI-2026-45084 CVE-2026-63178

Authorization bypass in onyx-dot-app onyx

MEDIUM 64

Onyx is an open-source AI platform.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00516 Published 2026-08-17 Fixed in 4.3.0 CWE-639

TI-2026-50048 CVE-2026-71424

Onyx: Cross-user OAuth-token leak via /api/mcp/servers* for per-user MCP servers

MEDIUM 43