CVE-2026-85178

CVE-2026-85178 is a broken object-level authorization flaw (CWE-639) in Helicone: the GET /v1/vault/key/{providerKeyId} endpoint does not verify that the requested vault key's organization matches the requester's organization. An attacker who holds admin or owner privileges in any organization on the deployment can call the endpoint with another tenant's provider key ID and retrieve it. The attacker gains decrypted plaintext credentials for upstream AI providers — including OpenAI, Anthropic, and Bedrock API keys — which can then be used or billed against other tenants' accounts. Affected parties are organizations running Helicone with the vault key feature in use, particularly multi-tenant deployments; single-tenant setups with one organization are largely unaffected. As of this writing there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS puts 30-day exploitation probability at roughly 0.2% (15th percentile), indicating no known exploitation.

What to do: Audit access to GET /v1/vault/key/{providerKeyId} in your Helicone deployment for cross-organization key retrievals and rotate any OpenAI, Anthropic, or Bedrock API keys stored in the vault if other tenants' admins could have queried them. Upgrade Helicone to a patched release that adds the organization check once one is published, and in the interim minimize the number of admin/owner accounts across organizations.