CVE-2026-85700: Onyx-Dot-App Onyx

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in custom_headers, allowing any authenticated user to read admin-defined API keys. Attackers with basic authentication can call GET /tool/{tool_id} or GET /tool endpoints to retrieve plaintext authorization headers and third-party API credentials, then use them to directly access upstream APIs.

Affected products

• Onyx-Dot-App Onyx: up to and including 4.6.6

Published 2026-09-04. Last modified 2026-09-23.