Get real-time updates on Telegram
CVE-2026-15508: ai-gateway 0.2.0-beta.0, 0.2.0-beta.1, 0.2.0-beta.2, 0.2.0-beta.3, 0.2.0-beta.4, 0.2.0-beta.5, 0.2.0-beta.6…
CVE-2026-15508. CVSS 3.1 base score 6.3 (MEDIUM, Vendor/CNA). EPSS 0.00347 (percentile 0.27151), scored 24-Oct-2026.
Affected technology
ai-gateway · 0.2.0-beta.0, 0.2.0-beta.1, 0.2.0-beta.2, 0.2.0-beta.3, 0.2.0-beta.4, 0.2.0-beta.5, 0.2.0-beta.6, 0.2.0-beta.7, 0.2.0-beta.8, 0.2.0-beta.9, 0.2.0-beta.10, 0.2.0-beta.11, 0.2.0-beta.12, 0.2.0-beta.13, 0.2.0-beta.14, 0.2.0-beta.15, 0.2.0-beta.16, 0.2.0-beta.17, 0.2.0-beta.18, 0.2.0-beta.19, 0.2.0-beta.20, 0.2.0-beta.21, 0.2.0-beta.22, 0.2.0-beta.23, 0.2.0-beta.24, 0.2.0-beta.25, 0.2.0-beta.26, 0.2.0-beta.27, 0.2.0-beta.28, 0.2.0-beta.29, 0.2.0-beta.30
Helicone
Description’s affected range: up to 0.2.0-beta.30
Component: AWS Metadata Service
Function: build_target_url
File: ai-gateway/src/dispatcher/service.rs
Attack conditions (VulDB, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required
What an attacker can do
VulDB’s CVSS 4.0 assessment (base score 2.1/10) rates confidentiality, integrity and availability impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.
- CWE
- CWE-918
- CCR priority
- 25.3 /100 (P4)
- CVSS 3.1
- 6.3 /10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L · Vendor/CNA
- EPSS
- 0.00347 · percentile 0.27151 · 2026-10-24
- KEV
- no
Provenance
- NVD CVE API 2.0 · Source record · observed 2026-10-25 01:28:19.133527+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-15508.html