CVE-2026-42276

MediumCVSS 4.3/10Last modified Nov 11, 2026

Description

Onyx is an open-source AI platform. Prior to versions 3.0.9, 3.1.6, and 3.2.6, the POST /chat/stop-chat-session/{chat_session_id} endpoint lets any authenticated user stop any other user's active chat session. The endpoint checks authentication but never verifies the session belongs to the caller. An attacker who knows a chat session UUID can kill another user's LLM generation mid-stream. This issue has been patched in versions 3.0.9, 3.1.6, and 3.2.6.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
onyx-dot-app	onyx	< 3.0.9; >= 3.1.0, < 3.1.6; >= 3.2.0, < 3.2.6

References

https://github.com/onyx-dot-app/onyx/security/advisories/GHSA-rw6w-hp62-gc8wExploit, Vendor Advisory
https://github.com/onyx-dot-app/onyx/security/advisories/GHSA-rw6w-hp62-gc8wExploit, Vendor Advisory

Timeline

Published: May 8, 2026
Last modified: Nov 11, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-422776.5Onyx is an open-source AI platform. Prior to versions 3.0.9, 3.1.6, and 3.2.6, the GET /chat/file/{file_id} endpoint allows any authenticate CVE-2026-422788.8UltraDAG is a minimal DAG-BFT blockchain in Rust. Prior to commit fb6ef59, the UltraDAG StateEngine implementation of SmartTransferTx contai CVE-2026-422795.8solidtime is an open-source time-tracking app. In version 0.12.0, the PUT /api/v1/organizations/{organization}/time-entries/{timeEntry} API CVE-2026-42289.8A vulnerability was detected in LB-LINK BL-WR9000 2.4.9. This affects the function sub_458754 of the file /goform/set_wifi. The manipulation CVE-2026-422807.1Auth0.js is a client-side JavaScript library for Auth0. From 8.11.0 to 9.32.0, under specific preconditions, the Auth0.js SDK may improperly CVE-2026-422818.6MagicMirror² is an open source modular smart mirror platform. Prior to 2.36.0, an unauthenticated Server-Side Request Forgery (SSRF) vulnera CVE-2026-422824.3n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to version 2.47.13,CVE-2026-422837.8DevSpace is a client-only developer tool for cloud-native development with Kubernetes. Prior to 6.3.21, DevSpace's UI server WebSocket accep CVE-2026-422849.8GitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the origi CVE-2026-422857.5GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.4.0, an unauthenticated re CVE-2026-422868.4Emlog is an open source website building system. Prior to version 2.6.11, missing CSRF protection in critical admin functions allows attacke CVE-2026-4228710.0Emlog is an open source website building system. Prior to version 2.6.11, direct SQL injection in article creation and update functions allo