CVE-2026-85700

Onyx 4.6.6 fails to properly restrict access to credentials that administrators store in the custom_headers field of custom tools (CWE-522, insufficiently protected credentials). Any authenticated user, including accounts with only basic privileges, can call GET /tool/{tool_id} or GET /tool and receive the plaintext authorization headers and admin-defined third-party API keys. With those credentials, an attacker can directly access the upstream APIs the keys belong to, bypassing Onyx's access controls and potentially consuming quota or reading data under the admin-defined credentials. Onyx 4.6.6 deployments (the disclosed version; the full affected version range is not specified) where admins configured custom tools with credentials are affected, and the attacker must already hold a valid user account on the instance. No public proof-of-concept, CISA KEV listing, or known exploitation exists; EPSS assigns a 0.3% probability of exploitation within 30 days (21st percentile).

What to do: Rotate any API keys stored in custom_headers on Onyx instances, since any authenticated user could have read them. Upgrade to a patched Onyx release when one is available (no fixed version is specified in this disclosure), and as an interim mitigation restrict access to the /tool and /tool/{tool_id} endpoints to admin roles.