Consequently, any authenticated user possessing admin or owner privileges within any organization using the Helicone platform can bypass intended access controls to retrieve decrypted, plaintext credentials. These credentials include sensitive upstream provider API keys for services such as OpenAI, Anthropic, and Amazon Bedrock. The scope of this issue is significant, as it permits unauthorized cross-tenant credential exfiltration, potentially enabling attackers to consume third-party API quotas or gain unauthorized access to LLM services on behalf of the victim organization. This vulnerability was disclosed on September 3, 2026, and is assigned a CVSS v3.1 base score of 7.7.

Impact

Successful exploitation allows for the unauthorized retrieval of plaintext API keys belonging to other tenants. This impact includes the potential for financial loss due to unauthorized API usage, exposure of proprietary LLM configurations, and a complete compromise of the credentials protecting downstream AI infrastructure. All organizations utilizing Helicone's vaulting features for API key management are at risk of cross-tenant credential exfiltration if they maintain multiple organizations on the platform.

Recommendation

Prioritized actions for security teams:

• Audit logs for the GET /v1/vault/key/ endpoint to identify abnormal patterns of access by user accounts.
• Review all API keys currently managed within the Helicone Vault for evidence of unauthorized usage or rotation requirements.
• Monitor Helicone vendor announcements for security patches addressing CVE-2026-85178 and apply them immediately upon availability.
• Implement monitoring for unusually high volumes of requests to the vault/key path emanating from authenticated administrative accounts.