EUVD-2026-70482
GHSA-2f4g-hjp3-9wf4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable IDOR with scope change to other tenants; PR:L reflects any-org admin requirement; no integrity or availability impact applies.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
5DescriptionCVE.org
Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKeyId} endpoint fails to validate the requester's organization against the vault key's organization identifier. Attackers with admin or owner privileges in any organization can retrieve decrypted upstream provider credentials for other tenants, including plaintext OpenAI, Anthropic, and Bedrock API keys.
AnalysisAI
Cross-tenant vault key disclosure in Helicone's AI proxy and observability platform exposes plaintext upstream provider credentials - including OpenAI, Anthropic, and AWS Bedrock API keys - to any authenticated admin or owner of a separate tenant organization. The vulnerability exists in VaultManager.getDecryptedProviderKeyById(), invoked via GET /v1/vault/key/{providerKeyId}, which decrypts and returns vault secrets without verifying that the requesting user's organization matches the organization that owns the target key. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold admin or owner role within any organization on the target Helicone deployment - this is the minimum authenticated privilege tier required, achievable by registering any account on the platform. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.3 with SC:H accurately reflects the cross-tenant blast radius: a single admin-level account in any low-value tenant organization can pivot to harvesting provider API keys from high-value tenants sharing the same Helicone deployment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream patch available at commit ca34549ea56f7ed587843f82d9cc19baa1f36ba4 (https://github.com/Helicone/helicone/commit/ca34549ea56f7ed587843f82d9cc19baa1f36ba4); a specific tagged release version incorporating this fix has not been confirmed in available data, so operators should verify their running commit against this hash. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Helicone deployments and review access logs for vault key retrieval attempts (GET /v1/vault/key/) across tenant boundaries. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today