CVE-2026-65957
Helio: Dashboard sideband CORS origin allowlist matches hostnames by prefix, admitting attacker-controlled origins in open mode
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Helio is an MCP proxy that sits between AI agents and the tools they use. Prior to version 0.8.0, the dashboard sideband (default 127.0.0.1:3100) validated CORS request origins by matching the hostname against a private-network string prefix (10., 172.16.–172.31., 192.168.) rather than validating an IP address. A public DNS name such as 192.168.attacker.com, 10.evil.io, or 172.16.pwn.example also satisfies that prefix, so the proxy echoed the attacker origin in Access-Control-Allow-Origin. This issue has been patched in version 0.8.0.
| CWE | CWE-346 CWE-942 |
| Vendor | gethelio |
| Product | helio |
| Published | Nov 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for gethelio helio
Be the first to know when new unknown vulnerabilities affecting gethelio helio are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
gethelio / helio
< 0.8.0
References
github.com: https://github.com/gethelio/helio/security/advisories/GHSA-2c3r-q7gv-hp2m github.com: https://github.com/gethelio/helio/pull/121 github.com: https://github.com/gethelio/helio/commit/4ca8329c38b0edbc5e4d782a4e3b0cfc5cd7782e github.com: https://github.com/gethelio/helio/releases/tag/v0.8.0