CVE-2026-71424

creationtimestamp| type| source ---|---|--- 2026-08-17 23:00:54+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtcsm7ra6a22 2026-08-17 23:41:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/gfy45mtzysrmc 2026-08-18 00:00:07+00:00| seen|...

CVE-2026-71424

Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/personaid endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.settokens and OnyxTokenStorage.setclientinfo in...