Skip to content

Onyx Community Edition

v4.1.1 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 1mo LLM Frameworks
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 3 known CVEs

Topics

ai ai-chat chatgpt chatui enterprise-search gen-ai
+7 more
information-retrieval llm llm-ui nextjs python self-hosted vector-db

Affected surfaces

auth rce_ssrf

ReleasePort's take

Moderate signal
editorial:auto 1mo

The release mandates USER_AUTH_SECRET for non‑dev deployments and hardens MinIO/S3 default credentials. It also adds consolidated SSRF protection, URL validation in the web‑connector, updated LLM routing, UI placeholder fixes, and sanitizes docx previews to block XSS.

Why it matters: Enforcing USER_AUTH_SECRET on all production environments eliminates unauthenticated access risk; hardening MinIO/S3 credentials prevents credential leakage. Sanitizing docx preview output blocks stored‑XSS attacks across file viewers.

Summary

AI summary

Updates web, web-connector, and llm across a mixed release.

Changes in this release

Security Critical

Require USER_AUTH_SECRET on non-dev deployments

Require USER_AUTH_SECRET on non-dev deployments

Source: llm_adapter@2026-06-13

Confidence: high

 —
Security High

Harden default MinIO/S3 object‑storage credentials

Harden default MinIO/S3 object‑storage credentials

Source: llm_adapter@2026-06-13

Confidence: high

 —
Security Medium

Sanitize docx‑preview output in file preview modal to prevent XSS

Sanitize docx‑preview output in file preview modal to prevent XSS

Source: llm_adapter@2026-06-13

Confidence: high

 —
Feature Medium

Consolidate SSRF protection into one admin setting

Consolidate SSRF protection into one admin setting

Source: llm_adapter@2026-06-13

Confidence: high

 —
Bugfix Medium

Apply URL validation across all fetch paths in web‑connector

Apply URL validation across all fetch paths in web‑connector

Source: llm_adapter@2026-06-13

Confidence: high

 —
Bugfix Medium

Route Claude Fable 5 / Mythos 5 through adaptive thinking in LLM module

Route Claude Fable 5 / Mythos 5 through adaptive thinking in LLM module

Source: llm_adapter@2026-06-13

Confidence: high

 —
Bugfix Low

Prevent shrinking of custom placeholders in PasswordInputTypeIn UI component

Prevent shrinking of custom placeholders in PasswordInputTypeIn UI component

Source: llm_adapter@2026-06-13

Confidence: high

 —
Full changelog

Warning

Do not upgrade to this release if you want to preserve your existing indexed documents but have not yet run the document index migration, which can be done from any version v3.x. See additional documentation here.

See the assets to download this version and install.

What's Changed

  • feat(security): consolidate SSRF protection into one admin setting (#11881) to release v4.1 by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/11970
  • fix(web-connector): apply URL validation across all fetch paths (#11973) to release v4.1 by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/11989
  • fix(llm): route Claude Fable 5 / Mythos 5 through adaptive thinking (#11992) to release v4.1 by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/11995
  • fix(security): harden default MinIO/S3 object-storage credentials (#12003) to release v4.1 by @jmelahman in https://github.com/onyx-dot-app/onyx/pull/12018
  • fix(security): require USER_AUTH_SECRET on non-dev deployments (#12038) to release v4.1 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12042
  • fix(web): don't shrink custom placeholders in PasswordInputTypeIn (#12041) to release v4.1 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12046
  • fix(web): sanitize docx-preview output in file preview modal (#12043) to release v4.1 by @onyx-cherry-pick[bot] in https://github.com/onyx-dot-app/onyx/pull/12047

Full Changelog: https://github.com/onyx-dot-app/onyx/compare/v4.1.0...v4.1.1

Security Fixes

  • feat(security): consolidate SSRF protection into one admin setting (#11881)
  • fix(security): harden default MinIO/S3 object‑storage credentials (#12003)
  • fix(security): require USER_AUTH_SECRET on non‑dev deployments (#12038)
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Onyx Community Edition

Get notified when new releases ship.

Sign up free

About Onyx Community Edition

Chat UI that works with any LLM. It comes loaded with advanced features like agents, web search, RAG, MCP, deep research, Connectors to 40+ knowledge sources, and more.

All releases →

Related context

Earlier breaking changes

  • v4.3.5 Requires running the OpenSearch document index migration before upgrading.
  • v4.0.2 Requires running the OpenSearch document index migration before upgrading to v4.0.
  • v3.3.7 Environment variable DANSWER_RUNNING_IN_DOCKER renamed to ONYX_RUNNING_IN_DOCKER.
  • v3.0.13 OpenSearch enabled as default search backend replacing Vespa
  • v3.0.13 License enforcement enabled by default in EE mode

Beta — feedback welcome: [email protected]