Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

onyx-dot-app/onyx

              main @ 7bd2744
            

221

Fixes

CVEs

CRITICAL

Peak severity

39.4%

Coverage

Highlights

Auth Bypass: 115 prior fixes. Scrutinize any change in this area.

backend/danswer/auth/users.py: most-fixed (19 issues). Treat as high-risk during review.

105 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: A default unconfigured admin API key allowed timing-attack-prone bypasses; this was resolved by failing closed and implementing constant-time comparison. Additionally, case-sensitivity discrepancies in email verification and insecure default user role creation during OAuth enrollment historically introduced major bypass opportunities.

SSRF: Untrusted sandbox workloads and automated connectors (such as Confluence, SharePoint, and web crawlers) frequently attempted outbound HTTP connections, risking access to internal loopback and link-local cloud metadata addresses. Defensive measures require deep host IP resolution checks and CIDR blocklists.

Broken Access Control: Authenticated users could view and use connector credential pairs belonging to other users due to a lack of ownership checks, culminating in CVE-2026-42277 and CVE-2026-42276. Similarly, chat files and session streams lacked explicit user validation, permitting cross-user document access and session manipulation.