What happened
CVE-2026-71424 (CVSS 9.6 Critical), published 2026-08-17, is a cross-user credential leak in Onyx's Model Context Protocol integration, where per-user OAuth tokens for MCP servers are stored in and served from a shared configuration object, letting a low-privileged user impersonate another user's authenticated connection to external MCP tool servers.
Why it matters
MCP servers are the standard mechanism for connecting AI agents to external tools and data sources; leaking another user's OAuth token lets an attacker impersonate that user against every connected external system (e.g. SaaS tools, internal APIs) reachable through Onyx's agent tooling.
Attack vector
GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} endpoints return a shared admin MCPConnectionConfig row's auth_template.headers because OnyxTokenStorage.set_tokens/set_client_info incorrectly copy per-user OAuth tokens into a shared config row; any BASIC_ACCESS user querying these endpoints receives another user's OAuth Authorization header for connected MCP servers.
Affected systems
Onyx (open-source AI platform), prior to 3.1.10, 3.2.14, and 4.0.0
Mitigation
Upgrade to Onyx >= 3.1.10 / 3.2.14 / 4.0.0; rotate OAuth tokens for connected MCP servers and audit MCP server access logs.