CVE-2026-42276: Onyx: IDOR in /chat/stop-chat-session allows any authenticated user to interrupt other users chat sessions
Onyx is an open-source AI platform. Prior to versions 3.0.9, 3.1.6, and 3.2.6, the POST /chat/stop-chat-session/{chatsessionid} endpoint lets any authenticated user stop any other user's active chat session. The endpoint checks authentication but never verifies the session belongs to the caller. An attacker who knows a chat session UUID can kill another user's LLM generation mid-stream. This issue has been patched in versions 3.0.9, 3.1.6, and 3.2.6.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42276?
CVE-2026-42276 has been rated as a high severity vulnerability due to its potential impact on user privacy and session integrity.
How do I fix CVE-2026-42276?
To mitigate CVE-2026-42276, update to Onyx version 3.0.9, 3.1.6, or 3.2.6 or later.
What type of vulnerability is CVE-2026-42276?
CVE-2026-42276 is classified as an Insecure Direct Object Reference (IDOR) vulnerability.
What impact does CVE-2026-42276 have on users?
CVE-2026-42276 allows any authenticated user to terminate other users' chat sessions, compromising user privacy.
Is CVE-2026-42276 present in all versions of Onyx?
CVE-2026-42276 affects versions of Onyx prior to 3.0.9, 3.1.6, and 3.2.6.