CVE-2026-108602

Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolv...

CVE-2026-108602 Helicone through v2025.08.21-1 SSRF via Jawn Webhook Sender DNS Resolution

Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolv...

CVE-2026-108602 Helicone through v2025.08.21-1 SSRF via Jawn Webhook Sender DNS Resolution

Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolv...

CVE-2026-108602 Helicone through v2025.08.21-1 SSRF via Jawn Webhook Sender DNS Resolution

Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolv...

CVE-2026-108602

The software Helicone (versions through v2025.08.21-1 ) is vulnerable to a Server-Side Request Forgery (SSRF) in the Jawn webhook sender component. The root cause allows authenticated organization users to reach internal services by providing hostnames that resolve to private addresses or utilize...

CVE-2026-108602: Server-Side Request Forgery (SSRF)

Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolv...

PT-2026-109747

Name of the Vulnerable Software and Affected Versions Helicone versions prior to 2025.08.21-2 Description A server-side request forgery SSRF issue exists in the Jawn webhook sender. This allows authenticated organization users to access internal services by utilizing hostnames that resolve to...

Helicone server request forgery vulnerability

Helicone v2025.08.21-1 and earlier versions have a server-side request forgeing vulnerability. This vulnerability stems from the Jawn webhook sender’s server-side request forgeing feature, which allows authenticated organizational users to access internal services by accessing hostnames that poin...