Helicone

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

Helicone records in CISA KEV

No Helicone vulnerabilities are listed in CISA KEV.

Records

3 records

TI-2026-58511 CVE-2026-85178 · GHSA-2f4g-hjp3-9wf4

Helicone Cross-Tenant Provider Key Disclosure via Missing Organization Filter

HIGH 69

Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKeyId} endpoint fails to validate the requester's organization against the vault key's organization identifier.

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00415 Published 2026-09-03 Fixed CWE-639

TI-2026-13047 CVE-2026-15508 · GHSA-9fxj-mchq-843p

Helicone ai-gateway AWS Metadata Service service.rs build_target_url server-side request forgery

MEDIUM 57

A flaw has been found in Helicone ai-gateway up to 0.2.0-beta.30.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00347 Published 2026-07-12 No fix listed CWE-918

TI-2026-70585 CVE-2026-108602 · GHSA-ch5j-5g34-4wwh

Server-side request forgery in Helicone Jawn webhook sender

LOW 23

Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to priva…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00213 Published 2026-10-10 No fix listed CWE-918

Open these records in search →

Critical	0
High	1
Medium	2
Low	0
No CVSS	0