Description

Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.set_tokens and OnyxTokenStorage.set_client_info in backend/onyx/server/features/mcp/api.py copy per-user tokens into a shared admin MCPConnectionConfig row and _db_mcp_server_to_api_mcp_server returns that row through auth_template.headers to any BASIC_ACCESS user. This issue is fixed in versions 3.1.10, 3.2.14, and 4.0.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-17T22:17:26.527Z",
  "pubdate": "2026-08-17T22:17:26.527Z",
  "executiveSummary": "Onyx, an open-source AI platform prior to versions 3.1.10, 3.2.14, and 4.0.0, suffers from an information disclosure vulnerability affecting the Model Context Protocol (MCP) server endpoints. The flaw allows authenticated users with BASIC_ACCESS privileges to access sensitive OAuth Authorization headers belonging to other users. This exposure occurs due to improper handling and sharing of per-user tokens within database storage and API response generation. An attacker with standard basic access capabilities can query specific API endpoints to harvest administrative or elevated OAuth credentials, potentially leading to unauthorized access, privilege escalation, and lateral movement across integrated services relying on the leaked tokens. The risk implications are severe, as exposed authorization material can compromise external resources and third-party integrations tied to the affected user accounts. Exploitation requires authenticated network access to the exposed endpoints and relies on the platform's flawed internal token mapping logic.",
  "technicalDetails": "The vulnerability resides in the backend/onyx/server/features/mcp/api.py component of the Onyx platform, specifically within the token storage and retrieval logic implemented by OnyxTokenStorage.set_tokens and OnyxTokenStorage.set_client_info, alongside the _db_mcp_server_to_api_mcp_server serialization function. The root cause of the flaw is the insecure practice of copying per-user OAuth tokens into a shared administrative MCPConnectionConfig database row. When multiple users interact with the system, their unique authentication tokens overwrite or commingle within this shared configuration storage mechanism. Subsequently, when requests are made to the GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} endpoints, the _db_mcp_server_to_api_mcp_server function retrieves this shared row and exposes the concatenated or improperly scoped tokens via the auth_template.headers field in the JSON response. Attack flow begins with an authenticated user possessing BASIC_ACCESS privileges sending a standard HTTP GET request to either of the vulnerable endpoints. Due to the lack of strict tenant or user isolation in the MCP connection configuration retrieval, the application returns the administrative MCPConnectionConfig row containing the sensitive OAuth Authorization header of another user. Post-exploitation impact includes the illicit acquisition of valid OAuth tokens, enabling the attacker to impersonate the affected user, access downstream enterprise systems, or abuse elevated permissions associated with the leaked credentials across the connected ecosystem. Affected versions include all deployments prior to 3.1.10, 3.2.14, and 4.0.0."
}