CVE-2026-15508: Helicone AI Gateway SSRF Vulnerability

CVE-2026-15508 Overview

CVE-2026-15508 is a Server-Side Request Forgery (SSRF) vulnerability in Helicone ai-gateway versions up to and including 0.2.0-beta.30. The flaw resides in the build_target_url function within ai-gateway/src/dispatcher/service.rs, where the extracted_path_and_query argument is not properly validated before being incorporated into an outbound HTTP request. An attacker with low privileges can remotely manipulate this input to coerce the gateway into contacting arbitrary hosts, including the AWS Instance Metadata Service (IMDS). A public exploit exists, and the vendor did not respond to disclosure attempts. The weakness is classified under CWE-918: Server-Side Request Forgery.

Critical Impact
Successful exploitation lets remote attackers pivot through the ai-gateway process to reach internal services and cloud metadata endpoints, potentially exposing AWS IAM credentials.

Affected Products

Helicone ai-gateway versions up to 0.2.0-beta.30
Deployments exposing the ai-gateway service on AWS EC2 or ECS with IMDSv1 reachable
Any environment routing untrusted client paths through build_target_url

Discovery Timeline

2026-07-12 - CVE-2026-15508 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-15508

Vulnerability Analysis

Helicone ai-gateway is a Rust-based proxy that forwards requests to upstream large language model providers. The build_target_url function in ai-gateway/src/dispatcher/service.rs constructs the outbound URL by concatenating an upstream base with the extracted_path_and_query value derived from the incoming HTTP request. Because the gateway does not restrict the resulting host or scheme, an attacker can supply crafted path components that alter the target of the outbound request. This turns the gateway into a confused deputy capable of issuing requests to internal-only endpoints on behalf of the attacker.

The public disclosure highlights the AWS Metadata Service as a practical target. Deployments running on EC2 with IMDSv1 enabled expose short-lived IAM credentials at http://169.254.169.254/latest/meta-data/iam/security-credentials/. Coercing the gateway to fetch this endpoint returns those credentials in the proxied response, enabling downstream compromise of the AWS environment.

Root Cause

The root cause is insufficient validation of user-controlled URL components inside build_target_url. The function accepts extracted_path_and_query from the client request and merges it into the outbound URL without enforcing an allow-list of upstream hosts, blocking link-local addresses, or normalizing path traversal sequences that could override the base URL.

Attack Vector

Exploitation requires network access to the ai-gateway HTTP listener and low-privilege authentication. The attacker sends a crafted request whose path or query manipulates the concatenation logic in build_target_url, causing the gateway to issue an outbound request to an attacker-chosen destination such as 169.254.169.254. The gateway then returns the fetched content to the attacker, disclosing internal service responses or cloud metadata. See the GitHub issue on CVE-Submit and the VulDB entry for CVE-2026-15508 for the disclosed proof of concept.

Detection Methods for CVE-2026-15508

Indicators of Compromise

Outbound connections from the ai-gateway process to 169.254.169.254 or other link-local addresses
Proxy access logs containing crafted path_and_query values with embedded schemes, absolute URLs, or repeated ../ sequences
Unexpected retrieval of AWS IAM credential blobs correlated with inbound requests from external clients

Detection Strategies

Inspect ai-gateway request logs for entries where the effective upstream host differs from the configured provider endpoint
Alert on any DNS resolution or TCP connection from the gateway host toward 169.254.169.254, metadata.google.internal, or RFC1918 ranges not present in the allow-list
Correlate inbound API paths with outbound URLs to identify path-injection patterns targeting build_target_url

Monitoring Recommendations

Forward ai-gateway access and error logs to a centralized analytics platform and baseline outbound destinations
Enable VPC Flow Logs and CloudTrail on hosts running the gateway to detect anomalous IMDS access and subsequent AWS API activity
Monitor use of any IAM role attached to the gateway instance for calls originating from unexpected IP addresses

How to Mitigate CVE-2026-15508

Immediate Actions Required

Restrict network egress from ai-gateway hosts to only the required LLM provider endpoints using host-based firewalls or security groups
Enforce IMDSv2 with HttpTokens=required and set HttpPutResponseHopLimit=1 on EC2 instances hosting the gateway
Rotate any IAM credentials associated with roles attached to affected instances and audit CloudTrail for prior misuse

Patch Information

At the time of publication, no vendor patch is referenced in the CVE record and the vendor did not respond to the disclosure. Track upstream commits to ai-gateway/src/dispatcher/service.rs and apply the fix that validates or allow-lists the resolved URL in build_target_url. Refer to the VulDB vulnerability record #377837 for updates.

Workarounds

Place ai-gateway behind a forward proxy that enforces an allow-list of upstream hostnames and drops requests to link-local or private ranges
Run the gateway in a network segment with no route to 169.254.169.254 and no attached cloud IAM role until a fix is available
Add a reverse-proxy rule that rejects inbound requests whose path or query contains absolute URLs, schemes, or traversal sequences before they reach the gateway

bash

# Configuration example: enforce IMDSv2 on the EC2 instance running ai-gateway
aws ec2 modify-instance-metadata-options \
  --instance-id i-0123456789abcdef0 \
  --http-tokens required \
  --http-put-response-hop-limit 1 \
  --http-endpoint enabled