Helicone through v2025.08.21-1 SSRF via Jawn Webhook Sender DNS Resolution

Advisories

Helicone through v2025.08.21-1 SSRF via Jawn Webhook Sender DNS Resolution

severity: medium
date: 10/10/2026
Affecting: helicone <= v2025.08.21-1
CVE: CVE-2026-108602
CWE: CWE-918 Server-Side Request Forgery (SSRF)
CVSS: 5.3
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
References: https://hackmd.io/@haind/helicone-webhook-dns-ssrf
https://github.com/Helicone/helicone/blob/067d9290acb4f1fc9320e902fc67b4b399b50363/valhalla/jawn/src/lib/clients/webhookSender.ts#L11-L76
https://github.com/Helicone/helicone/blob/067d9290acb4f1fc9320e902fc67b4b399b50363/valhalla/jawn/src/controllers/public/webhookController.ts#L64-L85
https://github.com/Helicone/helicone
Credit: HaiND from the Post and Telecommunication Institute of Technology
Description: Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolve or DNS-rebind to loopback or internal addresses, causing blind POST requests to internal HTTPS services.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo