https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-28T21:57:35.100636+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-85178 fkie_cve-2026-85178 2026-09-28T21:57:35.117973+00:00

Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKeyId} endpoint fails to validate the requester's organization against the vault key's organization identifier. Attackers with admin or owner privileges in any organization can retrieve decrypted upstream provider credentials for other tenants, including plaintext OpenAI, Anthropic, and Bedrock API keys.

 https://db.gcve.eu/vuln/ghsa-2f4g-hjp3-9wf4 GHSA-2f4g-hjp3-9wf4 2026-09-28T21:57:35.118043+00:00

Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKeyId} endpoint fails to validate the requester's organization against the vault key's organization identifier. Attackers with admin or owner privileges in any organization can retrieve decrypted upstream provider credentials for other tenants, including plaintext OpenAI, Anthropic, and Bedrock API keys.