{"id":"CVE-2026-85178","summary":"Helicone Cross-Tenant Provider Key Disclosure via Missing Organization Filter","details":"Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKeyId} endpoint fails to validate the requester's organization against the vault key's organization identifier. Attackers with admin or owner privileges in any organization can retrieve decrypted upstream provider credentials for other tenants, including plaintext OpenAI, Anthropic, and Bedrock API keys.","modified":"2026-09-05T03:50:00.502673509Z","published":"2026-09-03T14:12:17.690Z","database_specific":{"unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"fixed":"ca34549ea56f7ed587843f82d9cc19baa1f36ba4"}]}],"cna_assigner":"VulnCheck","cwe_ids":["CWE-639"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85178.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85178.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85178"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/helicone-cross-tenant-provider-key-disclosure-via-missing-organization-filter"},{"type":"REPORT","url":"https://github.com/Helicone/helicone/issues/5712"},{"type":"FIX","url":"https://github.com/Helicone/helicone/commit/ca34549ea56f7ed587843f82d9cc19baa1f36ba4"},{"type":"PACKAGE","url":"https://github.com/Helicone/helicone"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/helicone/helicone","events":[{"introduced":"0"},{"fixed":"ca34549ea56f7ed587843f82d9cc19baa1f36ba4"}],"database_specific":{"source":"REFERENCES"}}],"versions":["deploy-20260830-211941","deploy-20260830-205827","deploy-20260830-174119","deploy-20260826-000439","deploy-20260825-211313","deploy-20260823-013311","deploy-20260823-000047","deploy-20260816-202628","deploy-20260725-011005","deploy-20260705-055533","deploy-20260611-194628","deploy-20260611-192502","deploy-20260611-191943","deploy-3357ae6","deploy-20260514-182655","deploy-20260502-004858","deploy-20260422-180842","deploy-20260406-180718","deploy-aa7ea34","deploy-20260404-161229","deploy-20260402-044039","deploy-20260330-184651","deploy-20260319-192947","deploy-313f658","deploy-20260221-050711","deploy-20260220-045523","deploy-20260219-034814","deploy-1439dd4","deploy-20260217-201002","deploy-6916e19","deploy-4ffab58","deploy-4345e74","deploy-dfa37ff","deploy-cee99df","deploy-79aaeea","deploy-946e099","deploy-c9d6f73","deploy-20260122-185637","deploy-20260121-201815","deploy-20260121-041948","deploy-20260116-004201","deploy-20260115-040211","deploy-1244dc7","deploy-20260113-021326","deploy-20260109-223831","deploy-6e16840","deploy-0525053","deploy-20260107-223212","deploy-20251231-215324","deploy-20251230-005741","deploy-20251229-195327","deploy-20251224-052858","deploy-20251224-043107","deploy-20251221-181439","deploy-20251218-191937","deploy-a599e7d","deploy-3c2790e","deploy-9a32082","deploy-20251214-205335","deploy-0e456b8","deploy-20251214-060432","deploy-60c528b","deploy-20251209-192645","deploy-37aecc8","deploy-20251209-021849","deploy-6cd6420","deploy-f5a27ff","deploy-5eb85c5","deploy-20251208-185805","deploy-d8154b4","deploy-7dca78b","deploy-78fe611","deploy-c7f9651","deploy-0b127cd","deploy-20251126-014228","deploy-20251126-010116","deploy-20251124-215312","deploy-64a627f","deploy-20251122-051634","deploy-20251118-181016","deploy-20251117-215603","deploy-20251117-213715","deploy-f9e6c27","deploy-14f7fed","deploy-d0c3f47","deploy-20251112-173728","deploy-20251112-000830","deploy-340a8d0","deploy-63f1d31","deploy-20251106-193740","deploy-20251106-001458","deploy-3b3b108","deploy-343c275","deploy-20251031-040147","deploy-77f025e","deploy-20251030-213021","deploy-20251030-185352","deploy-ed575b9","deploy-20251028-235250","deploy-25e13f2","deploy-7901ebe","deploy-4ed2cd7","deploy-6726313","deploy-20251022-033525","deploy-20251022-001619","deploy-20251021-224113","deploy-20251021-170351","deploy-e3c3e8e","deploy-3cfba13","deploy-d5fb38a","deploy-582d21b","deploy-613676c","deploy-7af1a48","deploy-165e3f8","deploy-7eefa4d","deploy-a798a85","deploy-55f048c","deploy-0c105a2","deploy-dde4292","deploy-9fad9c6","deploy-9c9d1055d17e0d507795d68664336c20f44e30b9","deploy-a50562b","deploy-f1594af","deploy-20251007-001151","deploy-cf71b1de9da27f3a91802abda39bdf663631fc97","deploy-20251006-175253","deploy-20251004-020252","deploy-20251003-233204","deploy-20251003-200431","deploy-20251002-234953","deploy-20251002-215100","deploy-20251002-204814","deploy-20251002-002252","deploy-20251002-000157","deploy-b27141e","deploy-20251001-162256","deploy-20250930-190300","deploy-20250929-052414","deploy-ef6ee47","deploy-9e0e0b0","deploy-84009ca","deploy-20250926-214612","deploy-20250926-071319","deploy-20250925-155054","deploy-20250925-152451","deploy-20250925-074200","deploy-20250925-062136","deploy-20250925-051547","deploy-6986e43","deploy-64f75b5","deploy-5b7266021719eedf3d721a88188021b5d0e52bad","deploy-25ec5c","deploy-e786b45","deploy-4507558","deploy-cc895ac","deploy-44a277c","deploy-20250919-004706","deploy-4673812","deploy-a7989a9","deploy-183377c","deploy-7e2df1d","deploy-7043c661ce0049b12a05aab3289cf222ba0de7d5","deploy-7d2063d","deploy-8fb2a24","deploy-20250912-192653","deploy-711b3f9","deploy-521ede2","deploy-20250911-000030","deploy-20250910-222028","deploy-20250910-170257","deploy-20250905-191409","deploy-eb7586","deploy-20250905-015925","deploy-20250905-015236","deploy-20250904-172513","deploy-bb5780","deploy-13924ce1fbdd1a7a8d344b47f81d9e2797186ac1","deploy-20250903-125614","deploy-763a6d7","deploy-20250901-021805","deploy-3196a0d96bfa324e5e79f6f0e9778f264034a4eb","deploy-0acedeb60af485633575c1b94a7940691a2aec5c","deploy-20250831-185952","deploy-20250830-040036","deploy-20250830-034748","deploy-20250830-034640","deploy-20250830-031740","deploy-20250830-003701","deploy-20250829-225501","deploy-20250829-224808","deploy-20250829-005530","deploy-20250829-003825","deploy-20250828-055347","deploy-20250828-053737","deploy-20250828-045614","deploy-20250828-042231","deploy-20250828-034226","deploy-20250828-024841","deploy-b07951e49b2348e8c1d0b4ac811ac166490688f0","deploy-20250827-174753","deploy-20250826-235650","deploy-20250826-173034","deploy-20250826-171150","deploy-20250826-165954","deploy-20250826-000834","deploy-7b2b1de","deploy-016e83de004f260e44246db7981f68ca5c0f4f10","deploy-20250823-205133","deploy-20250822-220355","deploy-20250822-205210","deploy-20250822-191803","deploy-e1fd774d367818795cb37be7f3c405a460388b17","deploy-20250822-191114","deploy-helix-key","deploy-helix","v2025.08.21-1","v2025.08.21","deploy-20250820-233201","v2025.08.20","deploy-sorting_fixes","v1.0.0","deploy-039260b2b69c8cfa7c0e4a4f040d327a155b085b","deploy-20250816-181940","deploy-b9cf2e7364426e45728d5a66a943d34f1187d5ec","deploy-a068d293205011a626b7fc3cb87f30d0a769b762","deploy-20250814-075251","deploy-20250814-071632","deploy-20250814-060753","deploy-20250814-052645","deploy-20250814-002343","deploy-8eea9564fe52218ca628615d99df7b169260e22b","deploy-onboarding_v3","deploy-20250811-224619","deploy-20250811-222734","deploy-20250811-214627","deploy-20250811-201659","deploy-20250811-161426","deploy-20250810-212444","deploy-20250808-234809","deploy-6ae55456cc653826fea69aab6469cff44c57998d","deploy-20250808-212845","deploy-prompt_env_control","deploy-prompt_env_crud","deploy-222b86e7337d6ed596c50c3ad4d9465693389afa","deploy-6decdea6eefdb93d77c2d51ce9b4ae36653b4144","deploy-526012f94779ec5a6be03b3e1d9a7fd4931633c9","deploy-20250806-182636","deploy-d0143e166637d1a0e7632f66d621539466d6b5b0","deploy-68c224010c83c403eb61d9badded563b58a09426","deploy-20250805-053757","deploy-20250803-062530","deploy-20250803-042010","deploy-20250802-161156","deploy-f8a343e78bf6fdca4a8af5a737a49d2ec8ac5da5","deploy-openai_batch_costs","deploy-7ff06c69b929faf21502afcdafc9f3eb15da653b","deploy-prompt_traces","deploy-20250728-042306","deploy-vercel-ai-gateway-integration","deploy-5d235168284b357627cc5c89a8c9534838014fca","deploy-b65d045c5b1f5251e1ae34b2d06d377134e89cb7","deploy-65b516e355c59cc86ad242db55b9f788ade6118e","deploy-fix_cost_portal","deploy-admin_cost_portal","deploy-prompts_launch","deploy-0371ac14d0d15245fd9a9e471e351127be4a423d","deploy-b1b85e434ca3d18094f0de78718709806aeb8be4","deploy-121f90e63acc359deb8cd9913e96cf8a9f4557c9","deploy-21fdb304eae2c88affe996a8f48ece24a2c85db5","deploy-openrouter_claude4","deploy-llama_stream","deploy-llama_integration","deploy-c5a3daea6151ec662075bcff8fd83c56db1641bf","deploy-search_chat_openai_costs","deploy-grok-4-pricing","deploy-1041736820a6659c81e4a669f6ed4a190e81af3c","deploy-01c5507","deploy-18950ef87e4456532d68fdff0894c846bbd24771","deploy-1c522c2","deploy-o3_costs","deploy-8695a77","deploy-359665ec65f2da287254d8fda097bca1d5e4c2df","deploy-48bd0b0","deploy-dbf33793aa01515495ab4ca77959f971b4f22d2c","deploy-eecd401","deploy-f4a2550","deploy-322ea32530800108ce6cacb0ad416dff8d97f132","deploy-3911","deploy-Pr-3982","deploy-pr-3979","deploy-PR-3977","deploy-1e094a9d9d81b4946e6b4f5222895f795b8be691","deploy-jawn-updates-auth","deploy-0997e0c93c0387fc2fa724b7512c980b619fce15","deploy-updated-at-fix","deploy-optional_updated-at_build_fix","deploy-helicone-request-fix","deploy-faster_session_id","deploy-user_filters","deploy-user_ch_query_fix","deploy-user_ch_query","deploy-user_ch_fix","deploy-fix_user_query","deploy-users_page","deploy-user_rework","deploy-user_page_rework","deploy-3b20e1f36d5c244f140cea6a4fe92c7cb90b4c8e","deploy-track_cost_ux","deploy-b688f263f221469116bf4714f447b928f6cff7f7","deploy-oai_schema_body_processing","deploy-fix_anthropic_parsing","deploy-properties_mv","deploy-costs_ingestion","deploy-openai_body_processor","deploy-revert_session_rmt_work","deploy-session_rmt_update","deploy-cache_tokens","deploy-cost_calc_fix","deploy-filters_pkg","deploy-updated-autgh","deploy-fix-claude-fix-stripe","deploy-no-stripe-streams","deploy-no-stripe-cache","deploy-stripe-logs","deploy-b8820041ba0d899956c6111ae2fab3658e781531","deploy-668d6689fc279948ee1d27de1ae9e069f4b272d5","deploy-fix-curl","deploy-tmp-disable-consume","deploy-jawn-fix-builds","deploy-a38a549df33343c20f5f3aa82b54374aef587392","deploy-c1a1dfabf0b84eb9e410ded411789bf86371854a","deploy-cache_page_revamp","deploy-local_cache_metrics_fix","deploy-14a1e5c","deploy-grok_claude4_support","deploy-cache_metrics","deploy-9a63a410d36e5fd7faa1756c9e9ccb29e92d2cda","deploy-cae4572165f08719bc29d691a9da138350ec45ce","deploy-d5551ae87fcbdbbaf893bb34c1b5b6687e2a125f","deploy-22858d0d46572f0aaef18d633d677ac3a5d4c757","deploy-c28e706","deploy-cache-readd","deploy-rollback-jawn-cache","deploy-cache_rmt","deploy-cache_move","deploy-4b40abb825a2b6641c5ce2744977574e59e78a63","deploy-20250514-174814","deploy-502dea2c2ad9c57cad518efdb649bc3875b20b39-7","deploy-502dea2c2ad9c57cad518efdb649bc3875b20b39-5","deploy-502dea2c2ad9c57cad518efdb649bc3875b20b39-4","deploy-502dea2c2ad9c57cad518efdb649bc3875b20b39-3","deploy-502dea2c2ad9c57cad518efdb649bc3875b20b39-2","deploy-502dea2c2ad9c57cad518efdb649bc3875b20b39","v0.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85178.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N"}]}