CVE-2026-85700: Insufficiently Protected Credentials in onyx-dot-app onyx

CVE-2026-85700 describes a vulnerability in Onyx 4.6.6 where access controls on custom tool credentials stored in custom_headers are improperly enforced. Authenticated users with basic authentication can invoke GET /tool/{tool_id} or GET /tool endpoints to retrieve plaintext API keys and authorization headers defined by administrators. These credentials can then be used to access upstream APIs directly, bypassing intended access restrictions. The vulnerability has a CVSS 4.0 score of 7.1, indicating high severity. No official patch or remediation guidance is currently available, and no known exploits in the wild have been reported.

The vulnerability allows any authenticated user to read sensitive admin-defined API keys and authorization headers in plaintext. This exposure can lead to unauthorized access to upstream APIs, potentially compromising data confidentiality and integrity. The impact is significant given the high CVSS score and the ability to misuse privileged credentials.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user authentication to trusted personnel only and monitor access to the affected endpoints. Avoid exposing sensitive credentials in custom_headers or consider additional access controls if possible.