CVE-2026-85178: Helicone Cross-Tenant Provider Key Disclosure via Missing Organization Filter
Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKeyId} endpoint fails to validate the requester's organization against the vault key's organization identifier. Attackers with admin or owner privileges in any organization can retrieve decrypted upstream provider credentials for other tenants, including plaintext OpenAI, Anthropic, and Bedrock API keys.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs admin or owner privileges in any Helicone organization. No user interaction is required, and the vulnerable endpoint is reachable over the network.
What access does successful exploitation provide?
The attacker can retrieve decrypted upstream provider credentials belonging to other tenants. The disclosed credentials can include plaintext OpenAI, Anthropic, and Bedrock API keys.
How can I determine whether my deployment is affected?
Review whether your deployed Helicone code includes the organization validation for VaultManager.getDecryptedProviderKeyById() used by GET /v1/vault/key/{providerKeyId}. The referenced commit ca34549ea56f7ed587843f82d9cc19baa1f36ba4 is relevant to the fix.