CVE-2026-85700
Received Received - Intake

Onyx 4.6.6 Credential Exposure via Custom Tool Headers

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in custom_headers, allowing any authenticated user to read admin-defined API keys. Attackers with basic authentication can call GET /tool/{tool_id} or GET /tool endpoints to retrieve plaintext authorization headers and third-party API credentials, then use them to directly access upstream APIs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85700
EUVD
EUVD-2026-71149

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
onyx onyx 4.6.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Onyx 4.6.6 has an access control flaw where authenticated users can read admin-defined API keys stored in custom_headers. Attackers with basic authentication can retrieve plaintext authorization headers and third-party API credentials by calling specific endpoints like GET /tool/{tool_id} or GET /tool.

Detection Guidance

Check for unauthorized access to GET /tool/{tool_id} or GET /tool endpoints. Monitor logs for unusual API key retrieval attempts. Verify if plaintext credentials are exposed in custom_headers.

Impact Analysis

If you use Onyx 4.6.6, attackers with basic authentication could steal API keys and gain unauthorized access to upstream APIs, potentially leading to data breaches, service disruptions, or further exploitation of connected systems.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face compliance penalties and reputational damage.

Mitigation Strategies

Upgrade Onyx to a patched version. Restrict access to /tool endpoints. Rotate all exposed API keys and credentials. Implement stricter authentication controls for admin-defined tools.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85700. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart