CVE-2026-65957: Helio: Dashboard sideband CORS origin allowlist matches hostnames by prefix, admitting attacker-controlled origins in open mode
Helio is an MCP proxy that sits between AI agents and the tools they use. Prior to version 0.8.0, the dashboard sideband (default 127.0.0.1:3100) validated CORS request origins by matching the hostname against a private-network string prefix (10., 172.16.–172.31., 192.168.) rather than validating an IP address. A public DNS name such as 192.168.attacker.com, 10.evil.io, or 172.16.pwn.example also satisfies that prefix, so the proxy echoed the attacker origin in Access-Control-Allow-Origin. This issue has been patched in version 0.8.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Helioto a version that resolves this vulnerability.Fixed in 0.8.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Helio versions before 0.8.0 are affected where the dashboard sideband is in its default configuration at 127.0.0.1:3100. The vulnerable CORS validation applies to the dashboard sideband's open mode.
What does an attacker need to exploit this issue?
An attacker needs to cause a request with an Origin hostname beginning with a private-network-looking prefix, such as 10.evil.io, 172.16.pwn.example, or 192.168.attacker.com. The affected proxy then echoes that attacker-controlled origin in the Access-Control-Allow-Origin response header.
How can I determine whether an instance is affected?
Check the Helio version and whether the dashboard sideband is operating in open mode. Versions earlier than 0.8.0 use hostname prefix matching for the relevant CORS origin validation.
What is the remediation?
Upgrade Helio to version 0.8.0, which patches the CORS origin validation issue.