CVE-2026-85178
🟡 Monitoruj
Błąd w Helicone umożliwia atakującym dostęp do kluczy API innych organizacji.
CVSS
7.7
EPSS
0.2%
Exploit
none
Vendor
Opis źródłowy (NVD)
Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKeyId} endpoint fails to validate the requester's organization against the vault key's organization identifier. Attackers with admin or owner privileges in any organization can retrieve decrypted upstream provider credentials for other tenants, including plaintext OpenAI, Anthropic, and Bedrock API keys.
brak
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 7.7 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 0.2% |
| Opublikowano (NVD) | 2026-09-03 15:17:38 UTC |
| Ostatnia modyfikacja (NVD) | 2026-09-17 18:17:11 UTC |
Referencje
- https://github.com/Helicone/helicone ([email protected])
- https://github.com/Helicone/helicone/commit/ca34549ea56f7ed587843f82d9cc19baa1f36ba4 ([email protected])
- https://github.com/Helicone/helicone/issues/5712 ([email protected])
- https://www.vulncheck.com/advisories/helicone-cross-tenant-provider-key-disclosure-via-missing-organization-filter ([email protected])