CVE record published for a critical cross-user OAuth token leak in Onyx's MCP server endpoints

A CVE record for Onyx, an open-source AI platform that lets its users attach MCP servers to assistants, was published on 2026-08-17. CVE-2026-71424 describes a cross-user credential leak: two endpoints, GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id}, returned another user's OAuth Authorization header.

The record traces the flaw to how per-user tokens were stored. In backend/onyx/server/features/mcp/api.py, OnyxTokenStorage.set_tokens and OnyxTokenStorage.set_client_info copied a user's tokens into a shared admin MCPConnectionConfig row. The listing endpoints then serialized that row through _db_mcp_server_to_api_mcp_server, which returns auth_template.headers to any caller holding basic access. A user with the lowest access level could therefore read the bearer token another user had authorized for the same MCP server, and use it against that server directly.

CVSS 3.1 puts it at 9.6, critical, on the vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. Onyx published its own advisory, GHSA-q62f-rv3h-f822, on 2026-07-20 and rates it critical as well.

The fixed versions predate both records. Onyx released 3.1.10 and 3.2.14 on 2026-05-20 and 4.0.0 on 2026-05-26, and the CVE record names all three as carrying the fix. Deployments still on an earlier 3.1, 3.2 or 3.3 beta line are the ones the record covers.