Search
Find a vulnerability
Search criteria
4 vulnerabilities found for helicone by Helicone
CVE-2026-108602 (GCVE-0-2026-108602)
Vulnerability from nvd – Published: 2026-10-10 19:54 – Updated: 2026-10-10 19:54
VLAI
EPSS
VEX
Title
Helicone through v2025.08.21-1 SSRF via Jawn Webhook Sender DNS Resolution
Summary
Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolve or DNS-rebind to loopback or internal addresses, causing blind POST requests to internal HTTPS services.
Severity
4.3 (Medium)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind/helicone-webhook-dns-ssrf | third-party-advisory |
| https://github.com/Helicone/helicone/blob/067d929… | technical-description |
| https://github.com/Helicone/helicone/blob/067d929… | technical-description |
| https://github.com/Helicone/helicone | product |
| https://www.vulncheck.com/advisories/helicone-thr… | third-party-advisory |
Impacted products
Date Public
2026-10-09 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/Helicone/helicone",
"product": "helicone",
"repo": "https://github.com/Helicone/helicone",
"vendor": "Helicone",
"versions": [
{
"lessThanOrEqual": "v2025.08.21-1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolve or DNS-rebind to loopback or internal addresses, causing blind POST requests to internal HTTPS services."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T19:54:36.258Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haind/helicone-webhook-dns-ssrf"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Helicone/helicone/blob/067d9290acb4f1fc9320e902fc67b4b399b50363/valhalla/jawn/src/lib/clients/webhookSender.ts#L11-L76"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Helicone/helicone/blob/067d9290acb4f1fc9320e902fc67b4b399b50363/valhalla/jawn/src/controllers/public/webhookController.ts#L64-L85"
},
{
"tags": [
"product"
],
"url": "https://github.com/Helicone/helicone"
},
{
"name": "VulnCheck Advisory: Helicone through v2025.08.21-1 SSRF via Jawn Webhook Sender DNS Resolution",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/helicone-through-2025.08.21-1-ssrf-via-jawn-webhook-sender-dns-resolution"
}
],
"title": "Helicone through v2025.08.21-1 SSRF via Jawn Webhook Sender DNS Resolution",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-108602",
"datePublished": "2026-10-10T19:54:36.258Z",
"dateReserved": "2026-10-10T19:06:37.718Z",
"dateUpdated": "2026-10-10T19:54:36.258Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85178 (GCVE-0-2026-85178)
Vulnerability from nvd – Published: 2026-09-03 14:12 – Updated: 2026-09-24 14:20
VLAI
EPSS
VEX
Title
Helicone Cross-Tenant Provider Key Disclosure via Missing Organization Filter
Summary
Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKeyId} endpoint fails to validate the requester's organization against the vault key's organization identifier. Attackers with admin or owner privileges in any organization can retrieve decrypted upstream provider credentials for other tenants, including plaintext OpenAI, Anthropic, and Bedrock API keys.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-03 14:40 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/Helicone/helicone/issues/5712 | issue-tracking |
| https://github.com/Helicone/helicone | product |
| https://github.com/Helicone/helicone/commit/ca345… | patch |
| https://www.vulncheck.com/advisories/helicone-cro… | third-party-advisory |
Impacted products
Date Public
2026-07-05 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85178",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-03T14:40:59.326415Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T14:41:07.573Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Helicone/helicone/issues/5712"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/Helicone/helicone",
"product": "helicone",
"vendor": "Helicone",
"versions": [
{
"lessThan": "ca34549ea56f7ed587843f82d9cc19baa1f36ba4",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-07-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Helicone\u0027s VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKeyId} endpoint fails to validate the requester\u0027s organization against the vault key\u0027s organization identifier. Attackers with admin or owner privileges in any organization can retrieve decrypted upstream provider credentials for other tenants, including plaintext OpenAI, Anthropic, and Bedrock API keys."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:20:46.843Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #5712",
"tags": [
"issue-tracking"
],
"url": "https://github.com/Helicone/helicone/issues/5712"
},
{
"tags": [
"product"
],
"url": "https://github.com/Helicone/helicone"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Helicone/helicone/commit/ca34549ea56f7ed587843f82d9cc19baa1f36ba4"
},
{
"name": "VulnCheck Advisory: Helicone Cross-Tenant Provider Key Disclosure via Missing Organization Filter",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/helicone-cross-tenant-provider-key-disclosure-via-missing-organization-filter"
}
],
"title": "Helicone Cross-Tenant Provider Key Disclosure via Missing Organization Filter",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-85178",
"datePublished": "2026-09-03T14:12:17.690Z",
"dateReserved": "2026-09-03T11:08:17.526Z",
"dateUpdated": "2026-09-24T14:20:46.843Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108602 (GCVE-0-2026-108602)
Vulnerability from cvelistv5 – Published: 2026-10-10 19:54 – Updated: 2026-10-10 19:54
VLAI
EPSS
VEX
Title
Helicone through v2025.08.21-1 SSRF via Jawn Webhook Sender DNS Resolution
Summary
Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolve or DNS-rebind to loopback or internal addresses, causing blind POST requests to internal HTTPS services.
Severity
4.3 (Medium)
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind/helicone-webhook-dns-ssrf | third-party-advisory |
| https://github.com/Helicone/helicone/blob/067d929… | technical-description |
| https://github.com/Helicone/helicone/blob/067d929… | technical-description |
| https://github.com/Helicone/helicone | product |
| https://www.vulncheck.com/advisories/helicone-thr… | third-party-advisory |
Impacted products
Date Public
2026-10-09 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/Helicone/helicone",
"product": "helicone",
"repo": "https://github.com/Helicone/helicone",
"vendor": "Helicone",
"versions": [
{
"lessThanOrEqual": "v2025.08.21-1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolve or DNS-rebind to loopback or internal addresses, causing blind POST requests to internal HTTPS services."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T19:54:36.258Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haind/helicone-webhook-dns-ssrf"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Helicone/helicone/blob/067d9290acb4f1fc9320e902fc67b4b399b50363/valhalla/jawn/src/lib/clients/webhookSender.ts#L11-L76"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Helicone/helicone/blob/067d9290acb4f1fc9320e902fc67b4b399b50363/valhalla/jawn/src/controllers/public/webhookController.ts#L64-L85"
},
{
"tags": [
"product"
],
"url": "https://github.com/Helicone/helicone"
},
{
"name": "VulnCheck Advisory: Helicone through v2025.08.21-1 SSRF via Jawn Webhook Sender DNS Resolution",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/helicone-through-2025.08.21-1-ssrf-via-jawn-webhook-sender-dns-resolution"
}
],
"title": "Helicone through v2025.08.21-1 SSRF via Jawn Webhook Sender DNS Resolution",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-108602",
"datePublished": "2026-10-10T19:54:36.258Z",
"dateReserved": "2026-10-10T19:06:37.718Z",
"dateUpdated": "2026-10-10T19:54:36.258Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85178 (GCVE-0-2026-85178)
Vulnerability from cvelistv5 – Published: 2026-09-03 14:12 – Updated: 2026-09-24 14:20
VLAI
EPSS
VEX
Title
Helicone Cross-Tenant Provider Key Disclosure via Missing Organization Filter
Summary
Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKeyId} endpoint fails to validate the requester's organization against the vault key's organization identifier. Attackers with admin or owner privileges in any organization can retrieve decrypted upstream provider credentials for other tenants, including plaintext OpenAI, Anthropic, and Bedrock API keys.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-03 14:40 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/Helicone/helicone/issues/5712 | issue-tracking |
| https://github.com/Helicone/helicone | product |
| https://github.com/Helicone/helicone/commit/ca345… | patch |
| https://www.vulncheck.com/advisories/helicone-cro… | third-party-advisory |
Impacted products
Date Public
2026-07-05 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85178",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-03T14:40:59.326415Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T14:41:07.573Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Helicone/helicone/issues/5712"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/Helicone/helicone",
"product": "helicone",
"vendor": "Helicone",
"versions": [
{
"lessThan": "ca34549ea56f7ed587843f82d9cc19baa1f36ba4",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-07-05T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Helicone\u0027s VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKeyId} endpoint fails to validate the requester\u0027s organization against the vault key\u0027s organization identifier. Attackers with admin or owner privileges in any organization can retrieve decrypted upstream provider credentials for other tenants, including plaintext OpenAI, Anthropic, and Bedrock API keys."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T14:20:46.843Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #5712",
"tags": [
"issue-tracking"
],
"url": "https://github.com/Helicone/helicone/issues/5712"
},
{
"tags": [
"product"
],
"url": "https://github.com/Helicone/helicone"
},
{
"tags": [
"patch"
],
"url": "https://github.com/Helicone/helicone/commit/ca34549ea56f7ed587843f82d9cc19baa1f36ba4"
},
{
"name": "VulnCheck Advisory: Helicone Cross-Tenant Provider Key Disclosure via Missing Organization Filter",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/helicone-cross-tenant-provider-key-disclosure-via-missing-organization-filter"
}
],
"title": "Helicone Cross-Tenant Provider Key Disclosure via Missing Organization Filter",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-85178",
"datePublished": "2026-09-03T14:12:17.690Z",
"dateReserved": "2026-09-03T11:08:17.526Z",
"dateUpdated": "2026-09-24T14:20:46.843Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}