{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "fixed": "3.1.10"
              },
              {
                "introduced": "3.2.0"
              },
              {
                "fixed": "3.2.14"
              },
              {
                "introduced": "3.3.0-beta.0"
              },
              {
                "fixed": "4.0.0"
              }
            ],
            "source": [
              "AFFECTED_FIELD",
              "REFERENCES"
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "introduced": "c4f8d5370b8369176a77f0788da3fc4b133fb2db"
            },
            {
              "introduced": "634cb0b07a4c00ebd9ea4a5f2ad2112e1a85cd20"
            },
            {
              "fixed": "3f3d79d1a7722fdc84a1c61c8aa830d890017e9e"
            },
            {
              "fixed": "4001cedd0a8968723bfe95dd188914ed56777910"
            },
            {
              "fixed": "d59882f006ba6d060fecfbbfd79aeadd372905d8"
            },
            {
              "fixed": "b103937888fd5008067c2bb6eb6e5424576394f2"
            }
          ],
          "repo": "https://github.com/onyx-dot-app/onyx",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-q62f-rv3h-f822"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-200",
      "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71424.json"
  },
  "details": "Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.set_tokens and OnyxTokenStorage.set_client_info in backend/onyx/server/features/mcp/api.py copy per-user tokens into a shared admin MCPConnectionConfig row and _db_mcp_server_to_api_mcp_server returns that row through auth_template.headers to any BASIC_ACCESS user. This issue is fixed in versions 3.1.10, 3.2.14, and 4.0.0.",
  "id": "CVE-2026-71424",
  "modified": "2026-08-20T03:30:44.891954178Z",
  "published": "2026-08-17T21:28:32.814Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/onyx-dot-app/onyx/releases/tag/v4.0.0"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71424.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/onyx-dot-app/onyx/security/advisories/GHSA-q62f-rv3h-f822"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71424"
    },
    {
      "type": "FIX",
      "url": "https://github.com/onyx-dot-app/onyx/commit/3f3d79d1a7722fdc84a1c61c8aa830d890017e9e"
    },
    {
      "type": "FIX",
      "url": "https://github.com/onyx-dot-app/onyx/commit/4001cedd0a8968723bfe95dd188914ed56777910"
    },
    {
      "type": "FIX",
      "url": "https://github.com/onyx-dot-app/onyx/commit/b103937888fd5008067c2bb6eb6e5424576394f2"
    },
    {
      "type": "FIX",
      "url": "https://github.com/onyx-dot-app/onyx/pull/11238"
    },
    {
      "type": "FIX",
      "url": "https://github.com/onyx-dot-app/onyx/pull/11242"
    },
    {
      "type": "FIX",
      "url": "https://github.com/onyx-dot-app/onyx/pull/11243"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Onyx: Cross-user OAuth-token leak via /api/mcp/servers* for per-user MCP servers"
}