CVE-2026-15508CWE-918ssrf

CVE-2026-15508

Medium · published July 13, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
27.2
In the wild
Unconfirmed
What it is

A flaw has been found in Helicone ai-gateway up to 0.2.0-beta.30. This affects the function build_target_url of the file ai-gateway/src/dispatcher/service.rs of the component AWS Metadata Service. Executing a manipulation of the argument extracted_path_and_query can lead to server-side request forgery. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00347 · 27.2th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-07-13T03:16Z
References (5)
https://github.com/oscar2744/CVE-Submit/issues/1 · [email protected]https://vuldb.com/cve/CVE-2026-15508 · [email protected]https://vuldb.com/submit/845671 · [email protected]https://vuldb.com/vuln/377837 · [email protected]https://vuldb.com/vuln/377837/cti · [email protected]
EPSS history
Timeline
  • 12 JUL 22:15Z
    Helicone ai-gateway AWS Metadata Service service.rs build_target_url server-side request forgery
    cvelistv5