Executive brief
Onyx is an open-source AI platform used for managing and interacting with Large Language Models (LLMs). A security flaw in the platform allows any logged-in user to terminate the active chat sessions of other users. This can be used to disrupt operations by repeatedly killing AI text generation mid-stream, causing data loss for the victim and preventing them from receiving complete responses.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the `stop_chat_session` function within `backend/onyx/server/query_and_chat/chat_backend.py`. While the endpoint requires authentication, it fails to verify that the `chat_session_id` provided in the request belongs to the authenticated user. An attacker with a valid account can send a POST request to `/api/chat/stop-chat-session/{chat_session_id}` using another user's session UUID to trigger a 'stop' flag in the cache. This results in the immediate termination of the victim's active LLM generation. The issue is fixed in versions 3.0.9, 3.1.6, and 3.2.6 by implementing proper ownership checks.
Affected products
- Onyx Onyx < 3.0.9, >= 3.1.0 < 3.1.6, >= 3.2.0 < 3.2.6
Timeline
- 2026-04-29: advisory: GitHub Security Advisory published
- 2026-05-08: disclosed: CVE published to NVD