CVE-2026-71424

Name of the Vulnerable Software and Affected Versions Onyx versions prior to 3.1.10 Onyx versions prior to 3.2.14 Onyx versions prior to 4.0.0

Description An issue exists where the 'GET /api/mcp/servers' and 'GET /api/mcp/servers/persona/{persona id}' endpoints expose the OAuth Authorization header of other users. This occurs because the set tokens() and set client info() functions in OnyxTokenStorage copy per-user tokens into a shared admin MCPConnectionConfig row. Subsequently, the db mcp server to api mcp server() function returns this row via auth template.headers to any user with BASIC ACCESS privileges.

Recommendations Update to version 3.1.10. Update to version 3.2.14. Update to version 4.0.0.