Helicone
Monthly
Cross-tenant vault key disclosure in Helicone's AI proxy and observability platform exposes plaintext upstream provider credentials - including OpenAI, Anthropic, and AWS Bedrock API keys - to any authenticated admin or owner of a separate tenant organization. The vulnerability exists in VaultManager.getDecryptedProviderKeyById(), invoked via GET /v1/vault/key/{providerKeyId}, which decrypts and returns vault secrets without verifying that the requesting user's organization matches the organization that owns the target key. A vendor patch commit is available; no active exploitation or public proof-of-concept has been identified at time of analysis.
Server-side request forgery in Helicone ai-gateway (up to 0.2.0-beta.30) allows a low-privileged remote attacker to manipulate the `extracted_path_and_query` argument within the `build_target_url` function of the AWS Metadata Service component, causing the gateway to issue unauthorized server-side HTTP requests to internal infrastructure. For deployments on AWS, this most critically targets the EC2 Instance Metadata Service (IMDS) at 169.254.169.254, potentially exposing IAM role credentials that carry blast radius far exceeding the assigned CVSS 5.3 score. A public exploit exists via GitHub, and the vendor was unresponsive to pre-disclosure contact, meaning no vendor-confirmed patch is available at time of analysis.
Cross-tenant vault key disclosure in Helicone's AI proxy and observability platform exposes plaintext upstream provider credentials - including OpenAI, Anthropic, and AWS Bedrock API keys - to any authenticated admin or owner of a separate tenant organization. The vulnerability exists in VaultManager.getDecryptedProviderKeyById(), invoked via GET /v1/vault/key/{providerKeyId}, which decrypts and returns vault secrets without verifying that the requesting user's organization matches the organization that owns the target key. A vendor patch commit is available; no active exploitation or public proof-of-concept has been identified at time of analysis.
Server-side request forgery in Helicone ai-gateway (up to 0.2.0-beta.30) allows a low-privileged remote attacker to manipulate the `extracted_path_and_query` argument within the `build_target_url` function of the AWS Metadata Service component, causing the gateway to issue unauthorized server-side HTTP requests to internal infrastructure. For deployments on AWS, this most critically targets the EC2 Instance Metadata Service (IMDS) at 169.254.169.254, potentially exposing IAM role credentials that carry blast radius far exceeding the assigned CVSS 5.3 score. A public exploit exists via GitHub, and the vendor was unresponsive to pre-disclosure contact, meaning no vendor-confirmed patch is available at time of analysis.