CVE-2026-85700: Onyx Information Disclosure Vulnerability

CVE-2026-85700 Overview

CVE-2026-85700 is a credential disclosure vulnerability in Onyx 4.6.6 that exposes admin-defined API keys to any authenticated user. The application fails to restrict access to custom tool credentials stored in the custom_headers field of tool definitions. Attackers with basic authentication can query GET /tool/{tool_id} or GET /tool endpoints to retrieve plaintext authorization headers and third-party API credentials. Once obtained, these secrets grant direct access to upstream APIs that trust the disclosed keys. The vulnerability is categorized under CWE-522: Insufficiently Protected Credentials.

Critical Impact
Any authenticated Onyx user can extract admin-configured API keys and use them to access external services outside Onyx's control boundary.

Affected Products

Onyx 4.6.6 (backend tool API)
Onyx deployments exposing /tool and /tool/{tool_id} endpoints
Custom tool integrations configured with authorization headers or API keys in custom_headers

Discovery Timeline

2026-09-04 - CVE-2026-85700 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-85700

Vulnerability Analysis

Onyx allows administrators to configure custom tools that call third-party APIs. These tool definitions accept a custom_headers field where admins store authorization tokens, API keys, and other secret headers required by upstream services. The backend persists these headers alongside non-sensitive tool metadata such as the tool name and description.

The /tool and /tool/{tool_id} endpoints in backend/onyx/server/features/tool/api.py return the full tool object, including the custom_headers list, without redacting secret values. Authorization on these endpoints requires only a valid authenticated session, not administrative privileges. Any low-privileged user who can log in to Onyx can enumerate tools and read the plaintext header values.

With the disclosed credentials, an attacker bypasses Onyx entirely and interacts with the upstream APIs directly. This expands the blast radius beyond the Onyx application and into any SaaS, internal service, or LLM provider whose keys were configured as tool credentials.

Root Cause

The root cause is missing output filtering on the tool response model in backend/onyx/server/features/tool/models.py. Secret header values are serialized into API responses instead of being masked, hashed, or gated behind an admin-only endpoint. The authorization check treats read access to tool definitions as equivalent to read access to their embedded secrets.

Attack Vector

An authenticated attacker sends GET /tool to enumerate configured tools, then issues GET /tool/{tool_id} for each tool of interest. The JSON response includes the custom_headers array with header names and values in cleartext. The attacker copies the Authorization header or API key and replays it against the third-party endpoint documented in the tool definition. No exploit is required beyond standard HTTP client usage.

See the VulnCheck Onyx Advisory and GitHub Issue #13165 for reference details.

Detection Methods for CVE-2026-85700

Indicators of Compromise

Repeated GET /tool and GET /tool/{tool_id} requests from non-admin user sessions
Access to tool endpoints by service accounts or low-privileged users who do not manage integrations
Unexpected upstream API calls originating from IP addresses that also authenticated to Onyx
Anomalous usage spikes on third-party APIs whose keys are configured in Onyx custom tools

Detection Strategies

Enable verbose access logging on the Onyx backend and alert on GET /tool* requests grouped by user identity and volume
Correlate Onyx authentication events with subsequent tool enumeration to flag credential-harvesting behavior
Review upstream API provider logs for requests from IP addresses not previously associated with the Onyx server egress

Monitoring Recommendations

Instrument the Onyx reverse proxy to capture request URIs, user IDs, and response sizes for the /tool route
Forward Onyx application logs to a centralized SIEM and build a rule for non-admin access to tool endpoints
Rotate and monitor upstream API keys for out-of-band usage patterns that suggest key reuse outside the Onyx server

How to Mitigate CVE-2026-85700

Immediate Actions Required

Rotate all API keys, tokens, and secrets previously configured in Onyx custom tool custom_headers
Restrict network access to the Onyx /tool endpoints to administrative users only via a reverse proxy rule
Audit the Onyx user database and revoke sessions for accounts that should not have read access to tool definitions
Review upstream API provider logs for unauthorized use of the disclosed credentials

Patch Information

No fixed version is listed in the NVD entry at the time of publication. Track the Onyx GitHub repository and GitHub Issue #13165 for an official patch. Review the vulnerable code paths in backend/onyx/server/features/tool/api.py and backend/onyx/server/features/tool/models.py.

Workarounds

Front the Onyx API with a reverse proxy that blocks /tool and /tool/{tool_id} for non-admin roles
Remove sensitive credentials from custom_headers and instead proxy requests through a broker service that injects secrets server-side
Limit Onyx account provisioning to trusted users until an official patch is released
Store third-party API keys in a dedicated secrets manager and issue short-lived tokens scoped to the specific tool

bash

# Example NGINX rule to restrict tool endpoints to admin source IPs
location ~ ^/tool(/|$) {
    allow 10.0.0.0/24;   # admin subnet
    deny all;
    proxy_pass http://onyx_backend;
}