PT-2026-38660 · Onyx · Onyx

Abdrrahimdahmani · CVE-2026-42276 · Published 2026-05-08 · Updated 2026-05-12

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Onyx versions prior to 3.0.9 Onyx versions prior to 3.1.6 Onyx versions prior to 3.2.6

Description An issue in the AI platform allows an authenticated user to terminate another user's active chat session. The endpoint "/chat/stop-chat-session/{chat session id}" verifies authentication but fails to validate if the session belongs to the requester. An attacker with a chat session UUID can stop another user's Large Language Model (LLM) generation mid-stream.

Recommendations Update to version 3.0.9 Update to version 3.1.6 Update to version 3.2.6

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-42276

GHSA-RW6W-HP62-GC8W

Affected Products

Onyx

References · 7

• 🔥 https://github.com/onyx-dot-app/onyx/security/advisories/GHSA-rw6w-hp62-gc8w · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42276.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-42276 · Security Note
• https://osv.dev/vulnerability/CVE-2026-42276 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2052704308580299135 · Twitter Post
• https://t.me/cveNotify/163227 · Telegram Post
• https://twitter.com/CVEnew/status/2053174703552913917 · Twitter Post