Helicone CVE-2026-108602

Requires a valid authenticated account within a Helicone organization (PR:L) and access to the webhook-creation feature of the Jawn webhook sender. The attacker must control a public hostname whose DNS can resolve or be rebound to loopback/internal addresses, targeting an internal HTTPS service reachable from the Jawn backend. Limiting factors: exploitation is blind (POST-only, no response returned, VC:N), so it yields integrity-side effects on internal endpoints rather than data readback; it depends on the Jawn backend having network reachability to valuable internal services; and it is gated by org membership, so environments where all organization users are trusted face materially lower real-world risk. Affects Helicone through v2025.08.21-1.

This is a medium-severity SSRF (CWE-918) rated 5.3 via the provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with only Vulnerable-System Integrity impact (VI:L) and no confidentiality, availability, or subsequent-system impact. The signals are internally consistent and point to a real but bounded issue rather than a critical priority: exploitation is network-reachable and low-complexity, but PR:L confirms it requires an authenticated organization user, which substantially limits the attacker population to those who already hold a valid tenant account. No EPSS score, KEV listing, or explicit POC flag was provided in the input, so there is no evidence of active exploitation or automatable mass-exploitation; absence of these signals is not itself a risk-reducing guarantee but does argue against widespread opportunistic attacks. The blind nature of the SSRF (POST-only, no response returned to the attacker) and the VC:N/VI:L rating indicate the primary impact is limited integrity effects on reachable internal services rather than data exfiltration, consistent with a blind SSRF. A detailed technical writeup (hackmd.io) and a VulnCheck advisory exist and describe the DNS-rebinding technique, which lowers the effort to reproduce; treat this as a meaningful finding for anyone running self-hosted Helicone with untrusted org members, but not an emergency patch for environments where all org users are trusted.

An authenticated user in a Helicone organization creates a webhook pointing at a public hostname they control, which resolves (or is made to DNS-rebind) to a loopback or internal RFC1918 address. When Jawn's webhook sender fires, it issues a blind POST to that internal HTTPS endpoint, letting the attacker reach services not exposed to the internet (e.g., internal APIs or metadata/admin endpoints). A public technical writeup describing the DNS-rebinding method exists, lowering the barrier to reproduction, though no packaged exploit code was provided in the input.