Description

Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKeyId} endpoint fails to validate the requester's organization against the vault key's organization identifier. Attackers with admin or owner privileges in any organization can retrieve decrypted upstream provider credentials for other tenants, including plaintext OpenAI, Anthropic, and Bedrock API keys.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-09-03T15:17:38.933Z",
  "pubdate": "2026-09-03T15:17:38.933Z",
  "executiveSummary": "This vulnerability is classified as an Improper Authorization (Broken Access Control) flaw affecting the Helicone VaultManager component.\nThe vulnerability resides within the VaultManager.getDecryptedProviderKeyById() function, specifically invoked by the GET /v1/vault/key/{providerKeyId} API endpoint.\nThe root cause is a failure to perform server-side validation of the requesting user's organizational context against the organizational metadata associated with the requested vault key.\nThis allows an attacker possessing valid authentication credentials—specifically those with admin or owner privileges within any Helicone organization—to bypass multi-tenancy logical isolation.\nSuccessful exploitation permits unauthorized access to plaintext upstream provider credentials, including sensitive API keys for OpenAI, Anthropic, and Amazon Bedrock.\nThe risk implication is severe, as it facilitates cross-tenant data exfiltration and potential downstream service compromise by exposing secret keys belonging to other Helicone customers.\nExploitation requires a valid, authenticated session as an organization owner or administrator; no specialized exploitation tools are necessary beyond standard API interaction capabilities.",
  "technicalDetails": "The vulnerability exists in the implementation of the GET /v1/vault/key/{providerKeyId} endpoint, which delegates credential retrieval to the VaultManager.getDecryptedProviderKeyById() function.\nThe internal logic of getDecryptedProviderKeyById() performs an identity check to verify that the requester is authenticated but fails to cross-reference the requesting user's organization_id with the organization_id mapped to the target providerKeyId in the backend database.\nBecause the system trusts that a user requesting a specific key ID is authorized to access it based solely on the user's role status (admin/owner) rather than the ownership association, the access control check is effectively neutralized.\nThe attack flow proceeds as follows: First, an attacker authenticates to the Helicone platform using a legitimate account. Second, the attacker identifies a target providerKeyId, which may be discovered through enumeration, internal knowledge, or predictable ID patterns. Third, the attacker initiates a GET request to /v1/vault/key/{providerKeyId}. Finally, the server-side logic processes the request, retrieves the requested decrypted key from the vault, and returns the plaintext secret to the unauthorized requester because the validation layer fails to perform a cross-tenant boundary check.\nThe vulnerability specifically impacts the integrity and confidentiality of third-party API provider secrets managed within the Helicone Vault.\nAs the application is designed for multi-tenancy, the failure to enforce mandatory access control (MAC) at the object level results in a complete bypass of the security boundary, allowing lateral movement between tenant data stores.\nPost-exploitation impact involves the total compromise of sensitive upstream credentials, which the attacker can subsequently use to conduct unauthorized API calls, exhaust quota limits, or perform further malicious activities using the victim's resources.\nThe lack of ownership validation persists regardless of the provider type, affecting any provider key stored within the vault system.\nThe vulnerability is fundamentally a failure to implement the principle of least privilege at the API service layer, where the authorization scope is improperly widened to include all keys across the platform for any administrative account."
}