CVE-2026-71424: Onyx: Cross-user OAuth-token leak via /api/mcp/servers* for per-user MCP servers
Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/{personaid} endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.settokens and OnyxTokenStorage.setclientinfo in backend/onyx/server/features/mcp/api.py copy per-user tokens into a shared admin MCPConnectionConfig row and dbmcpservertoapimcpserver returns that row through authtemplate.headers to any BASICACCESS user. This issue is fixed in versions 3.1.10, 3.2.14, and 4.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Onyxto a version that resolves this vulnerability.Fixed in 3.1.10 - Upgrade
Upgrade
Onyxto a version that resolves this vulnerability.Fixed in 3.2.14 - Upgrade
Upgrade
Onyxto a version that resolves this vulnerability.Fixed in 4.0.0
Event History
Frequently Asked Questions
Which deployments and users are exposed?
Instances running a version earlier than 3.1.10, 3.2.14, or 4.0.0 are affected. Exposure requires per-user MCP servers and users with BASIC_ACCESS, because the affected endpoints can return OAuth Authorization headers stored in the shared admin MCP connection configuration.
What access does an attacker need to exploit this?
An attacker needs an account with BASIC_ACCESS and network access to the affected API endpoints. No user interaction is required, and the attacker can retrieve another user's OAuth Authorization header through GET /api/mcp/servers or GET /api/mcp/servers/persona/{persona_id}.
What should teams do to remediate or reduce risk?
Upgrade to 3.1.10, 3.2.14, or 4.0.0, as applicable. If immediate patching is not possible, the provided data does not specify a supported workaround; limiting BASIC_ACCESS access and restricting access to the affected endpoints may reduce exposure.
How can administrators determine whether they may be affected?
Review whether the instance runs a version prior to the fixed releases and uses per-user MCP servers. On affected versions, responses from the two listed MCP server endpoints to BASIC_ACCESS users may expose OAuth Authorization headers belonging to other users.