EUVD-2026-43249
GHSA-9fxj-mchq-843p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Scope changes to subsequent AWS system (IAM via IMDS); confidentiality high if credentials exposed; PR:L per provided CVSS 4.0 vector.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in Helicone ai-gateway up to 0.2.0-beta.30. This affects the function build_target_url of the file ai-gateway/src/dispatcher/service.rs of the component AWS Metadata Service. Executing a manipulation of the argument extracted_path_and_query can lead to server-side request forgery. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Server-side request forgery in Helicone ai-gateway (up to 0.2.0-beta.30) allows a low-privileged remote attacker to manipulate the extracted_path_and_query argument within the build_target_url function of the AWS Metadata Service component, causing the gateway to issue unauthorized server-side HTTP requests to internal infrastructure. For deployments on AWS, this most critically targets the EC2 Instance Metadata Service (IMDS) at 169.254.169.254, potentially exposing IAM role credentials that carry blast radius far exceeding the assigned CVSS 5.3 score. A public exploit exists via GitHub, and the vendor was unresponsive to pre-disclosure contact, meaning no vendor-confirmed patch is available at time of analysis.
Technical ContextAI
Helicone AI Gateway is an open-source reverse proxy and observability platform for LLM API calls. The flaw resides in ai-gateway/src/dispatcher/service.rs within the build_target_url function, which constructs upstream request URLs from user-supplied path and query components. CWE-918 (Server-Side Request Forgery) applies when an application uses attacker-controlled input to build URLs for internal HTTP requests without validating the target destination. In AWS-hosted deployments, this opens the link-local address 169.254.169.254 (or the IMDSv2 endpoint) to attacker-directed requests. Affected scope per CPE is cpe:2.3:a:helicone:ai-gateway:*:*:*:*:*:*:*:*, covering all versions through 0.2.0-beta.30. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L confirms network-reachable exploitation with low privilege and no attack preconditions beyond authentication.
RemediationAI
No vendor-released patch is identified at time of analysis - the vendor did not respond to the coordinated disclosure. The most impactful immediate compensating control for AWS deployments is enforcing IMDSv2 (token-required mode) on all EC2 instances running Helicone, which prevents unauthenticated metadata retrieval even if SSRF is achieved; this has no functional impact on the gateway itself. Additionally, configure host-level or VPC-level egress firewall rules to block outbound requests to 169.254.254.169/32 from the gateway process, preventing metadata access entirely. For non-AWS environments, implement egress filtering to block requests to RFC 1918 addresses and other link-local ranges from the gateway service. Network-level WAF rules blocking path segments containing '169.254' or 'metadata' can add a detection layer. Until an official patched release is published, review the public POC at https://github.com/oscar2724/CVE-Submit/issues/1 to understand the precise attack surface and validate whether your deployment's path-handling matches the vulnerable pattern.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today