Cross-Tenant Provider Key Disclosure in Helicone's VaultManager

CVE-2026-85178

What is CVE-2026-85178?

The VaultManager.getDecryptedProviderKeyById() function in Helicone's API lacks adequate validation, allowing users with admin or owner privileges from one organization to access decrypted provider credentials, including sensitive API keys belonging to other organizations. This flaw poses a significant risk by enabling arbitrary access to critical credentials, leaving data and system integrity vulnerable to potential breaches. It is imperative for organizations utilizing this service to implement patches and apply stricter access controls to mitigate this risk.

References