Vulnerability · Published Sep 3, 2026 · Assigned by VulnCheck

CVE-2026-85178Helicone Cross-Tenant Provider Key Disclosure via Missing Organization Filter

High 7.7

In plain English

A high-severity authorization bypass via user-controlled key in helicone from Helicone. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.4%top 64.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKeyId} endpoint fails to validate the requester's organization against the vault key's organization identifier. Attackers with admin or owner privileges in any organization can retrieve decrypted upstream provider credentials for other tenants, including plaintext OpenAI, Anthropic, and Bedrock API keys.

Affected products (as reported)

Vendor	Product	Versions
Helicone	helicone	0 – before ca34549ea56f7ed587843f82d9cc19baa1f36ba4

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References

GitHub Issue #5712 issue-tracking
https://github.com/Helicone/helicone product
https://github.com/Helicone/helicone/commit/ca34549ea56f7ed587843f82d9cc19baa1f36ba4 patch
VulnCheck Advisory: Helicone Cross-Tenant Provider Key Disclosure via Missing Organization Filter third-party-advisory