CVE-2026-42276
Medium
Description
Onyx is an open-source AI platform. Prior to versions 3.0.9, 3.1.6, and 3.2.6, the POST /chat/stop-chat-session/{chat_session_id} endpoint lets any authenticated user stop any other user's active chat session. The endpoint checks authentication but never verifies the session belongs to the caller. An attacker who knows a chat session UUID can kill another user's LLM generation mid-stream. This issue has been patched in versions 3.0.9, 3.1.6, and 3.2.6.
SeverityMedium
CVSS4.3
Exploit probability—
ProductOnyx
PublishedMay 8, 2026
First seenMay 8, 2026
How to fix
Update
- onyx onyx3.0.9, 3.1.6, 3.2.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| onyx onyx | v < 3.0.9, 3.1.0 ≤ v < 3.1.6, 3.2.0 ≤ v < 3.2.6 | 3.0.9, 3.1.6, 3.2.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.