# CVE-2026-71424: Onyx MCP servers endpoint information disclosure

Source: https://junglewise.ai/threats/cve-2026-71424-onyx-mcp-servers-endpoint-information-disclosure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-71424 · Severity: critical · CVSS 9.6 · Published 2026-08-17

Onyx is an open-source AI platform that manages external integrations through MCP (Model Context Protocol) server connections. A flaw in the API endpoints allows any authenticated user to retrieve OAuth credentials and authorization headers belonging to other users by reading shared configuration data, enabling account takeover and unauthorized API access.

Technologies: [Onyx](https://junglewise.ai/threats/technologies/onyx). Vendors: [Onyx](https://junglewise.ai/threats/vendors/onyx).

## Quick answers

**Is CVE-2026-71424 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-71424 being exploited in the wild.

**How severe is CVE-2026-71424?** Critical severity, with a CVSS score of 9.6, published 17 August 2026.

**Which products and versions are affected?** Onyx prior to 3.1.10, 3.2.14, and 4.0.0.

**Is there a fix for CVE-2026-71424?** A patch was published on 2026-08-17: Fixed in versions 3.1.10, 3.2.14, and 4.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-71424 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-71424?** Check whether you run Onyx at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an information disclosure flaw in Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} endpoints. The root cause lies in OnyxTokenStorage.set_tokens and OnyxTokenStorage.set_client_info functions in backend/onyx/server/features/mcp/api.py, which incorrectly store per-user OAuth tokens in a shared admin MCPConnectionConfig database row. The _db_mcp_server_to_api_mcp_server function then returns this shared row—including auth_template.headers containing OAuth Authorization headers—to any user with BASIC_ACCESS privilege. An authenticated attacker can call these endpoints to retrieve other users' OAuth credentials. The vulnerability is fixed in versions 3.1.10, 3.2.14, and 4.0.0.

## Affected products

- Onyx Onyx prior to 3.1.10, 3.2.14, and 4.0.0

## Timeline

- 2026-08-17: disclosed
- 2026-08-17: patched: Fixed in versions 3.1.10, 3.2.14, and 4.0.0

## References

- [https://github.com/onyx-dot-app/onyx/commit/3f3d79d1a7722fdc84a1c61c8aa830d890017e9e](https://github.com/onyx-dot-app/onyx/commit/3f3d79d1a7722fdc84a1c61c8aa830d890017e9e)
- [https://github.com/onyx-dot-app/onyx/commit/4001cedd0a8968723bfe95dd188914ed56777910](https://github.com/onyx-dot-app/onyx/commit/4001cedd0a8968723bfe95dd188914ed56777910)

## Related threats

- [Onyx credential disclosure in custom tool endpoints](https://junglewise.ai/threats/cve-2026-85700-onyx-credential-disclosure-in-custom-tool-endpoints)