Onyx
Security Risk Profile
Security Risk Score
Comprehensive risk assessment based on 9 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from March 20, 2025 to present
Threat Assessment
Severity Distribution
Exploit Likelihood
Age Distribution
Common Weaknesses (CWE)
Most Affected Products
Recent Vulnerabilities
See more →Onyx 4.6.6 Custom Tool Secret Header Disclosure via Tool Endpoints
Onyx Curator-scope IDOR: any curator can modify membership of arbitrary user groups via unscoped PATCH /manage/admin/user-group/{id} and /add-users leading to cross-group document disclosure
Onyx: Cross-user OAuth-token leak via /api/mcp/servers* for per-user MCP servers
Onyx: IDOR in /chat/file/{file_id} allows any authenticated user to download other users files
Onyx: IDOR in /chat/stop-chat-session allows any authenticated user to interrupt other users chat sessions
Onyx Chat Interface a3_generate_simple_sql.py generate_simple_sql sql injection
Improper Access Control in danswer-ai/danswer
Unauthorized Access in danswer-ai/danswer
Monitor Onyx in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.