CyberRota Analysis
AI-GeneratedOnyx 4.6.6 is vulnerable due to inadequate access controls on custom tool credentials stored in custom_headers, enabling any authenticated user to access sensitive admin-defined API keys. This flaw allows attackers with basic authentication to exploit the GET /tool/{tool_id} or GET /tool endpoints, potentially compromising upstream APIs with the retrieved plaintext credentials. Organizations using this version should prioritize remediation to mitigate the risk of unauthorized access to critical services.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in custom_headers, allowing any authenticated user to read admin-defined API keys. Attackers with basic authentication can call GET /tool/{tool_id} or GET /tool endpoints to retrieve plaintext authorization headers and third-party API credentials, then use them to directly access upstream APIs.