CVE-2026-85178

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-85178

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85178.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-85178

Published

2026-09-03T14:12:17Z

Modified

2026-09-05T03:50:00Z

Severity

8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N CVSS Calculator

Summary

Helicone Cross-Tenant Provider Key Disclosure via Missing Organization Filter

Details

Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKeyId} endpoint fails to validate the requester's organization against the vault key's organization identifier. Attackers with admin or owner privileges in any organization can retrieve decrypted upstream provider credentials for other tenants, including plaintext OpenAI, Anthropic, and Bedrock API keys.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85178.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "ca34549ea56f7ed587843f82d9cc19baa1f36ba4"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/helicone/helicone

Affected ranges

Type

GIT

Repo

https://github.com/helicone/helicone

Events

Introduced

Fixed

ca34549ea56f7ed587843f82d9cc19baa1f36ba4

Database specific

Show details

{
    "source": "REFERENCES"
}

Affected versions

Other

deploy-016e83de004f260e44246db7981f68ca5c0f4f10

deploy-01c5507

deploy-0371ac14d0d15245fd9a9e471e351127be4a423d

deploy-039260b2b69c8cfa7c0e4a4f040d327a155b085b

deploy-0525053

deploy-0997e0c93c0387fc2fa724b7512c980b619fce15

deploy-0acedeb60af485633575c1b94a7940691a2aec5c

deploy-0b127cd

deploy-0c105a2

deploy-0e456b8

deploy-1041736820a6659c81e4a669f6ed4a190e81af3c

deploy-121f90e63acc359deb8cd9913e96cf8a9f4557c9

deploy-1244dc7

deploy-13924ce1fbdd1a7a8d344b47f81d9e2797186ac1

deploy-1439dd4

deploy-14a1e5c

deploy-14f7fed

deploy-165e3f8

deploy-183377c

deploy-18950ef87e4456532d68fdff0894c846bbd24771

deploy-1c522c2

deploy-1e094a9d9d81b4946e6b4f5222895f795b8be691

deploy-20250514-174814

deploy-20250728-042306

deploy-20250802-161156

deploy-20250803-042010

deploy-20250803-062530

deploy-20250805-053757

deploy-20250806-182636

deploy-20250808-212845

deploy-20250808-234809

deploy-20250810-212444

deploy-20250811-161426

deploy-20250811-201659

deploy-20250811-214627

deploy-20250811-222734

deploy-20250811-224619

deploy-20250814-002343

deploy-20250814-052645

deploy-20250814-060753

deploy-20250814-071632

deploy-20250814-075251

deploy-20250816-181940

deploy-20250820-233201

deploy-20250822-191114

deploy-20250822-191803

deploy-20250822-205210

deploy-20250822-220355

deploy-20250823-205133

deploy-20250826-000834

deploy-20250826-165954

deploy-20250826-171150

deploy-20250826-173034

deploy-20250826-235650

deploy-20250827-174753

deploy-20250828-024841

deploy-20250828-034226

deploy-20250828-042231

deploy-20250828-045614

deploy-20250828-053737

deploy-20250828-055347

deploy-20250829-003825

deploy-20250829-005530

deploy-20250829-224808

deploy-20250829-225501

deploy-20250830-003701

deploy-20250830-031740

deploy-20250830-034640

deploy-20250830-034748

deploy-20250830-040036

deploy-20250831-185952

deploy-20250901-021805

deploy-20250903-125614

deploy-20250904-172513

deploy-20250905-015236

deploy-20250905-015925

deploy-20250905-191409

deploy-20250910-170257

deploy-20250910-222028

deploy-20250911-000030

deploy-20250912-192653

deploy-20250919-004706

deploy-20250925-051547

deploy-20250925-062136

deploy-20250925-074200

deploy-20250925-152451

deploy-20250925-155054

deploy-20250926-071319

deploy-20250926-214612

deploy-20250929-052414

deploy-20250930-190300

deploy-20251001-162256

deploy-20251002-000157

deploy-20251002-002252

deploy-20251002-204814

deploy-20251002-215100

deploy-20251002-234953

deploy-20251003-200431

deploy-20251003-233204

deploy-20251004-020252

deploy-20251006-175253

deploy-20251007-001151

deploy-20251021-170351

deploy-20251021-224113

deploy-20251022-001619

deploy-20251022-033525

deploy-20251028-235250

deploy-20251030-185352

deploy-20251030-213021

deploy-20251031-040147

deploy-20251106-001458

deploy-20251106-193740

deploy-20251112-000830

deploy-20251112-173728

deploy-20251117-213715

deploy-20251117-215603

deploy-20251118-181016

deploy-20251122-051634

deploy-20251124-215312

deploy-20251126-010116

deploy-20251126-014228

deploy-20251208-185805

deploy-20251209-021849

deploy-20251209-192645

deploy-20251214-060432

deploy-20251214-205335

deploy-20251218-191937

deploy-20251221-181439

deploy-20251224-043107

deploy-20251224-052858

deploy-20251229-195327

deploy-20251230-005741

deploy-20251231-215324

deploy-20260107-223212

deploy-20260109-223831

deploy-20260113-021326

deploy-20260115-040211

deploy-20260116-004201

deploy-20260121-041948

deploy-20260121-201815

deploy-20260122-185637

deploy-20260217-201002

deploy-20260219-034814

deploy-20260220-045523

deploy-20260221-050711

deploy-20260319-192947

deploy-20260330-184651

deploy-20260402-044039

deploy-20260404-161229

deploy-20260406-180718

deploy-20260422-180842

deploy-20260502-004858

deploy-20260514-182655

deploy-20260611-191943

deploy-20260611-192502

deploy-20260611-194628

deploy-20260705-055533

deploy-20260725-011005

deploy-20260816-202628

deploy-20260823-000047

deploy-20260823-013311

deploy-20260825-211313

deploy-20260826-000439

deploy-20260830-174119

deploy-20260830-205827

deploy-20260830-211941

deploy-21fdb304eae2c88affe996a8f48ece24a2c85db5

deploy-222b86e7337d6ed596c50c3ad4d9465693389afa

deploy-22858d0d46572f0aaef18d633d677ac3a5d4c757

deploy-25e13f2

deploy-25ec5c

deploy-313f658

deploy-3196a0d96bfa324e5e79f6f0e9778f264034a4eb

deploy-322ea32530800108ce6cacb0ad416dff8d97f132

deploy-3357ae6

deploy-340a8d0

deploy-343c275

deploy-359665ec65f2da287254d8fda097bca1d5e4c2df

deploy-37aecc8

deploy-3911

deploy-3b20e1f36d5c244f140cea6a4fe92c7cb90b4c8e

deploy-3b3b108

deploy-3c2790e

deploy-3cfba13

deploy-4345e74

deploy-44a277c

deploy-4507558

deploy-4673812

deploy-48bd0b0

deploy-4b40abb825a2b6641c5ce2744977574e59e78a63

deploy-4ed2cd7

deploy-4ffab58

deploy-502dea2c2ad9c57cad518efdb649bc3875b20b39

deploy-502dea2c2ad9c57cad518efdb649bc3875b20b39-2

deploy-502dea2c2ad9c57cad518efdb649bc3875b20b39-3

deploy-502dea2c2ad9c57cad518efdb649bc3875b20b39-4

deploy-502dea2c2ad9c57cad518efdb649bc3875b20b39-5

deploy-502dea2c2ad9c57cad518efdb649bc3875b20b39-7

deploy-521ede2

deploy-526012f94779ec5a6be03b3e1d9a7fd4931633c9

deploy-55f048c

deploy-582d21b

deploy-5b7266021719eedf3d721a88188021b5d0e52bad

deploy-5d235168284b357627cc5c89a8c9534838014fca

deploy-5eb85c5

deploy-60c528b

deploy-613676c

deploy-63f1d31

deploy-64a627f

deploy-64f75b5

deploy-65b516e355c59cc86ad242db55b9f788ade6118e

deploy-668d6689fc279948ee1d27de1ae9e069f4b272d5

deploy-6726313

deploy-68c224010c83c403eb61d9badded563b58a09426

deploy-6916e19

deploy-6986e43

deploy-6ae55456cc653826fea69aab6469cff44c57998d

deploy-6cd6420

deploy-6decdea6eefdb93d77c2d51ce9b4ae36653b4144

deploy-6e16840

deploy-7043c661ce0049b12a05aab3289cf222ba0de7d5

deploy-711b3f9

deploy-763a6d7

deploy-77f025e

deploy-78fe611

deploy-7901ebe

deploy-79aaeea

deploy-7af1a48

deploy-7b2b1de

deploy-7d2063d

deploy-7dca78b

deploy-7e2df1d

deploy-7eefa4d

deploy-7ff06c69b929faf21502afcdafc9f3eb15da653b

deploy-84009ca

deploy-8695a77

deploy-8eea9564fe52218ca628615d99df7b169260e22b

deploy-8fb2a24

deploy-946e099

deploy-9a32082

deploy-9a63a410d36e5fd7faa1756c9e9ccb29e92d2cda

deploy-9c9d1055d17e0d507795d68664336c20f44e30b9

deploy-9e0e0b0

deploy-9fad9c6

deploy-PR-3977

deploy-Pr-3982

deploy-a068d293205011a626b7fc3cb87f30d0a769b762

deploy-a38a549df33343c20f5f3aa82b54374aef587392

deploy-a50562b

deploy-a599e7d

deploy-a7989a9

deploy-a798a85

deploy-aa7ea34

deploy-admin_cost_portal

deploy-b07951e49b2348e8c1d0b4ac811ac166490688f0

deploy-b1b85e434ca3d18094f0de78718709806aeb8be4

deploy-b27141e

deploy-b65d045c5b1f5251e1ae34b2d06d377134e89cb7

deploy-b688f263f221469116bf4714f447b928f6cff7f7

deploy-b8820041ba0d899956c6111ae2fab3658e781531

deploy-b9cf2e7364426e45728d5a66a943d34f1187d5ec

deploy-bb5780

deploy-c1a1dfabf0b84eb9e410ded411789bf86371854a

deploy-c28e706

deploy-c5a3daea6151ec662075bcff8fd83c56db1641bf

deploy-c7f9651

deploy-c9d6f73

deploy-cache-readd

deploy-cache_metrics

deploy-cache_move

deploy-cache_page_revamp

deploy-cache_rmt

deploy-cache_tokens

deploy-cae4572165f08719bc29d691a9da138350ec45ce

deploy-cc895ac

deploy-cee99df

deploy-cf71b1de9da27f3a91802abda39bdf663631fc97

deploy-cost_calc_fix

deploy-costs_ingestion

deploy-d0143e166637d1a0e7632f66d621539466d6b5b0

deploy-d0c3f47

deploy-d5551ae87fcbdbbaf893bb34c1b5b6687e2a125f

deploy-d5fb38a

deploy-d8154b4

deploy-dbf33793aa01515495ab4ca77959f971b4f22d2c

deploy-dde4292

deploy-dfa37ff

deploy-e1fd774d367818795cb37be7f3c405a460388b17

deploy-e3c3e8e

deploy-e786b45

deploy-eb7586

deploy-ed575b9

deploy-eecd401

deploy-ef6ee47

deploy-f1594af

deploy-f4a2550

deploy-f5a27ff

deploy-f8a343e78bf6fdca4a8af5a737a49d2ec8ac5da5

deploy-f9e6c27

deploy-faster_session_id

deploy-filters_pkg

deploy-fix-claude-fix-stripe

deploy-fix-curl

deploy-fix_anthropic_parsing

deploy-fix_cost_portal

deploy-fix_user_query

deploy-grok-4-pricing

deploy-grok_claude4_support

deploy-helicone-request-fix

deploy-helix

deploy-helix-key

deploy-jawn-fix-builds

deploy-jawn-updates-auth

deploy-llama_integration

deploy-llama_stream

deploy-local_cache_metrics_fix

deploy-no-stripe-cache

deploy-no-stripe-streams

deploy-o3_costs

deploy-oai_schema_body_processing

deploy-onboarding_v3

deploy-openai_batch_costs

deploy-openai_body_processor

deploy-openrouter_claude4

deploy-optional_updated-at_build_fix

deploy-pr-3979

deploy-prompt_env_control

deploy-prompt_env_crud

deploy-prompt_traces

deploy-prompts_launch

deploy-properties_mv

deploy-revert_session_rmt_work

deploy-rollback-jawn-cache

deploy-search_chat_openai_costs

deploy-session_rmt_update

deploy-sorting_fixes

deploy-stripe-logs

deploy-tmp-disable-consume

deploy-track_cost_ux

deploy-updated-at-fix

deploy-updated-autgh

deploy-user_ch_fix

deploy-user_ch_query

deploy-user_ch_query_fix

deploy-user_filters

deploy-user_page_rework

deploy-user_rework

deploy-users_page

deploy-vercel-ai-gateway-integration

v0.*

v0.0.1

v1.*

v1.0.0

v2025.*

v2025.08.20

v2025.08.21

v2025.08.21-1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85178.json"