« Volver al listado

CVE-2026-42276

Estado: AnalizadaMedia (4.3)—

Onyx is an open-source AI platform. Prior to versions 3.0.9, 3.1.6, and 3.2.6, the POST /chat/stop-chat-session/{chat_session_id} endpoint lets any authenticated user stop any other user's active chat session. The endpoint checks authentication but never verifies the session belongs to the caller. An attacker who knows a chat session UUID can kill another user's LLM generation mid-stream. This issue has been patched in versions 3.0.9, 3.1.6, and 3.2.6.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Onyx — Onyx

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-42276",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-42276",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-08T12:56:45.370877Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "onyx-dot-app",
          "product": "onyx",
          "versions": [
            {
              "status": "affected",
              "version": "< 3.0.9"
            },
            {
              "status": "affected",
              "version": ">= 3.1.0, < 3.1.6"
            },
            {
              "status": "affected",
              "version": ">= 3.2.0, < 3.2.6"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-08T05:16:10.557",
  "references": [
    {
      "url": "https://github.com/onyx-dot-app/onyx/security/advisories/GHSA-rw6w-hp62-gc8w",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/onyx-dot-app/onyx/security/advisories/GHSA-rw6w-hp62-gc8w",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Onyx is an open-source AI platform. Prior to versions 3.0.9, 3.1.6, and 3.2.6, the POST /chat/stop-chat-session/{chat_session_id} endpoint lets any authenticated user stop any other user's active chat session. The endpoint checks authentication but never verifies the session belongs to the caller. An attacker who knows a chat session UUID can kill another user's LLM generation mid-stream. This issue has been patched in versions 3.0.9, 3.1.6, and 3.2.6."
    }
  ],
  "lastModified": "2026-06-17T10:47:37.107",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:onyx:onyx:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8EA5C508-9DEA-44FA-A188-0B1B87FEDBDE",
              "versionEndExcluding": "3.0.9"
            },
            {
              "criteria": "cpe:2.3:a:onyx:onyx:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ABCC8200-5559-45DD-87E8-1CAD6E7D6828",
              "versionEndExcluding": "3.1.6",
              "versionStartIncluding": "3.1.0"
            },
            {
              "criteria": "cpe:2.3:a:onyx:onyx:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F4E43C7B-9888-4225-86E0-0309E34186D2",
              "versionEndExcluding": "3.2.6",
              "versionStartIncluding": "3.2.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}