CVE-2026-108602

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-108602
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108602.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-108602
Published
2026-10-10T19:54:36Z
Modified
2026-10-12T02:31:20Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Helicone through v2025.08.21-1 SSRF via Jawn Webhook Sender DNS Resolution
Details

Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolve or DNS-rebind to loopback or internal addresses, causing blind POST requests to internal HTTPS services.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108602.json"
}
References

Affected packages

Git / github.com/helicone/helicone

Affected ranges

Type
GIT
Repo
https://github.com/helicone/helicone
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f74f255faaedcdbf72968f220e1ca6163c2bc15c
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "v2025.08.21-1"
        },
        {
            "fixed": "v2025.08.21-1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

Other
deploy-01c5507
deploy-0371ac14d0d15245fd9a9e471e351127be4a423d
deploy-039260b2b69c8cfa7c0e4a4f040d327a155b085b
deploy-0997e0c93c0387fc2fa724b7512c980b619fce15
deploy-1041736820a6659c81e4a669f6ed4a190e81af3c
deploy-121f90e63acc359deb8cd9913e96cf8a9f4557c9
deploy-14a1e5c
deploy-18950ef87e4456532d68fdff0894c846bbd24771
deploy-1c522c2
deploy-1e094a9d9d81b4946e6b4f5222895f795b8be691
deploy-20250514-174814
deploy-20250728-042306
deploy-20250802-161156
deploy-20250803-042010
deploy-20250803-062530
deploy-20250805-053757
deploy-20250806-182636
deploy-20250808-212845
deploy-20250808-234809
deploy-20250810-212444
deploy-20250811-161426
deploy-20250811-201659
deploy-20250811-214627
deploy-20250811-222734
deploy-20250811-224619
deploy-20250814-002343
deploy-20250814-052645
deploy-20250814-060753
deploy-20250814-071632
deploy-20250814-075251
deploy-20250816-181940
deploy-20250820-233201
deploy-21fdb304eae2c88affe996a8f48ece24a2c85db5
deploy-222b86e7337d6ed596c50c3ad4d9465693389afa
deploy-22858d0d46572f0aaef18d633d677ac3a5d4c757
deploy-322ea32530800108ce6cacb0ad416dff8d97f132
deploy-359665ec65f2da287254d8fda097bca1d5e4c2df
deploy-3911
deploy-3b20e1f36d5c244f140cea6a4fe92c7cb90b4c8e
deploy-48bd0b0
deploy-4b40abb825a2b6641c5ce2744977574e59e78a63
deploy-502dea2c2ad9c57cad518efdb649bc3875b20b39
deploy-502dea2c2ad9c57cad518efdb649bc3875b20b39-2
deploy-502dea2c2ad9c57cad518efdb649bc3875b20b39-3
deploy-502dea2c2ad9c57cad518efdb649bc3875b20b39-4
deploy-502dea2c2ad9c57cad518efdb649bc3875b20b39-5
deploy-502dea2c2ad9c57cad518efdb649bc3875b20b39-7
deploy-526012f94779ec5a6be03b3e1d9a7fd4931633c9
deploy-5d235168284b357627cc5c89a8c9534838014fca
deploy-65b516e355c59cc86ad242db55b9f788ade6118e
deploy-668d6689fc279948ee1d27de1ae9e069f4b272d5
deploy-68c224010c83c403eb61d9badded563b58a09426
deploy-6ae55456cc653826fea69aab6469cff44c57998d
deploy-6decdea6eefdb93d77c2d51ce9b4ae36653b4144
deploy-7ff06c69b929faf21502afcdafc9f3eb15da653b
deploy-8695a77
deploy-8eea9564fe52218ca628615d99df7b169260e22b
deploy-9a63a410d36e5fd7faa1756c9e9ccb29e92d2cda
deploy-PR-3977
deploy-Pr-3982
deploy-a068d293205011a626b7fc3cb87f30d0a769b762
deploy-a38a549df33343c20f5f3aa82b54374aef587392
deploy-admin_cost_portal
deploy-b1b85e434ca3d18094f0de78718709806aeb8be4
deploy-b65d045c5b1f5251e1ae34b2d06d377134e89cb7
deploy-b688f263f221469116bf4714f447b928f6cff7f7
deploy-b8820041ba0d899956c6111ae2fab3658e781531
deploy-b9cf2e7364426e45728d5a66a943d34f1187d5ec
deploy-c1a1dfabf0b84eb9e410ded411789bf86371854a
deploy-c28e706
deploy-c5a3daea6151ec662075bcff8fd83c56db1641bf
deploy-cache-readd
deploy-cache_metrics
deploy-cache_move
deploy-cache_page_revamp
deploy-cache_rmt
deploy-cache_tokens
deploy-cae4572165f08719bc29d691a9da138350ec45ce
deploy-cost_calc_fix
deploy-costs_ingestion
deploy-d0143e166637d1a0e7632f66d621539466d6b5b0
deploy-d5551ae87fcbdbbaf893bb34c1b5b6687e2a125f
deploy-dbf33793aa01515495ab4ca77959f971b4f22d2c
deploy-eecd401
deploy-f4a2550
deploy-f8a343e78bf6fdca4a8af5a737a49d2ec8ac5da5
deploy-faster_session_id
deploy-filters_pkg
deploy-fix-claude-fix-stripe
deploy-fix-curl
deploy-fix_anthropic_parsing
deploy-fix_cost_portal
deploy-fix_user_query
deploy-grok-4-pricing
deploy-grok_claude4_support
deploy-helicone-request-fix
deploy-jawn-fix-builds
deploy-jawn-updates-auth
deploy-llama_integration
deploy-llama_stream
deploy-local_cache_metrics_fix
deploy-no-stripe-cache
deploy-no-stripe-streams
deploy-o3_costs
deploy-oai_schema_body_processing
deploy-onboarding_v3
deploy-openai_batch_costs
deploy-openai_body_processor
deploy-openrouter_claude4
deploy-optional_updated-at_build_fix
deploy-pr-3979
deploy-prompt_env_control
deploy-prompt_env_crud
deploy-prompt_traces
deploy-prompts_launch
deploy-properties_mv
deploy-revert_session_rmt_work
deploy-rollback-jawn-cache
deploy-search_chat_openai_costs
deploy-session_rmt_update
deploy-sorting_fixes
deploy-stripe-logs
deploy-tmp-disable-consume
deploy-track_cost_ux
deploy-updated-at-fix
deploy-updated-autgh
deploy-user_ch_fix
deploy-user_ch_query
deploy-user_ch_query_fix
deploy-user_filters
deploy-user_page_rework
deploy-user_rework
deploy-users_page
deploy-vercel-ai-gateway-integration
v0.*
v0.0.1
v1.*
v1.0.0
v2025.*
v2025.08.20
v2025.08.21

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108602.json"