Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Onyx is an open-source AI platform. Prior to versions 3.0.9, 3.1.6, and 3.2.6, the POST /chat/stop-chat-session/{chat_session_id} endpoint lets any authenticated user stop any other user's active chat session. The endpoint checks authentication but never verifies the session belongs to the caller. An attacker who knows a chat session UUID can kill another user's LLM generation mid-stream. This issue has been patched in versions 3.0.9, 3.1.6, and 3.2.6.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-42276 Onyx is an open-source AI platform. Prior to versions 3.0.9, 3.1.6, and 3.2.6, the POST /chat/stop-chat-session/{chat_session_id} endpoint lets any authenticated user… https://www.cve.org/CVERecord?id=CVE-2026-42276
Post summary
CVE-2026-42276 discloses that, before versions 3.0.9, 3.1.6, and 3.2.6, any authenticated user can invoke the POST /chat/stop-chat-session endpoint to stop chatbot sessions.
CVE-2026-42276 Unauthorized Chat Session Termination in Onyx AI Platform Version... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42276 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
A brief notice referring to CVE‑2026‑42276, describing an unauthorized chat session termination vulnerability in Onyx AI Platform, with a link to vulnerability details but no PoC, exploit, patch, or active exploitation information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | onyx | onyx | - | - | - |