CVE-2026-108602
Helicone through v2025.08.21-1 SSRF via Jawn Webhook Sender DNS Resolution
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolve or DNS-rebind to loopback or internal addresses, causing blind POST requests to internal HTTPS services.
| CWE | CWE-918 |
| Vendor | helicone |
| Product | helicone |
| Published | Oct 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for helicone helicone
Be the first to know when new medium vulnerabilities affecting helicone helicone are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected Versions
Helicone / helicone
0 ≤ v2025.08.21-1
References
hackmd.io: https://hackmd.io/@haind/helicone-webhook-dns-ssrf github.com: https://github.com/Helicone/helicone/blob/067d9290acb4f1fc9320e902fc67b4b399b50363/valhalla/jawn/src/lib/clients/webhookSender.ts#L11-L76 github.com: https://github.com/Helicone/helicone/blob/067d9290acb4f1fc9320e902fc67b4b399b50363/valhalla/jawn/src/controllers/public/webhookController.ts#L64-L85 github.com: https://github.com/Helicone/helicone vulncheck.com: https://www.vulncheck.com/advisories/helicone-through-2025.08.21-1-ssrf-via-jawn-webhook-sender-dns-resolution
Credits
HaiND from the Post and Telecommunication Institute of Technology