Quick answers
- Is CVE-2026-42276 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-42276 being exploited in the wild.
- How severe is CVE-2026-42276?
- Medium severity, with a CVSS score of 4.3, published 8 May 2026.
- Which products and versions are affected?
- Onyx Onyx < 3.0.9, >= 3.1.0 < 3.1.6, >= 3.2.0 < 3.2.6.
- Is there a fix for CVE-2026-42276?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-42276 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-42276?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the `stop_chat_session` function within `backend/onyx/server/query_and_chat/chat_backend.py`. While the endpoint requires authentication, it fails to verify that the `chat_session_id` provided in the request belongs to the authenticated user. An attacker with a valid account can send a POST request to `/api/chat/stop-chat-session/{chat_session_id}` using another user's session UUID to trigger a 'stop' flag in the cache. This results in the immediate termination of the victim's active LLM generation. The issue is fixed in versions 3.0.9, 3.1.6, and 3.2.6 by implementing proper ownership checks.
Affected products
- Onyx Onyx < 3.0.9, >= 3.1.0 < 3.1.6, >= 3.2.0 < 3.2.6
Timeline
- 2026-04-29: advisory: GitHub Security Advisory published
- 2026-05-08: disclosed: CVE published to NVD