GHSA-2c3r-q7gv-hp2m: Helio: Dashboard sideband CORS origin allowlist matches hostnames by prefix, admitting attacker-controlled origins in open mode
Helio is an MCP proxy that sits between AI agents and the tools they use. Prior to version 0.8.0, the dashboard sideband (default 127.0.0.1:3100) validated CORS request origins by matching the hostname against a private-network string prefix (10., 172.16.–172.31., 192.168.) rather than validating an IP address. A public DNS name such as 192.168.attacker.com, 10.evil.io, or 172.16.pwn.example also satisfies that prefix, so the proxy echoed the attacker origin in Access-Control-Allow-Origin. This issue has been patched in version 0.8.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Helioto a version that resolves this vulnerability.Fixed in 0.8.0
Event History
Frequently Asked Questions
Which deployments are affected?
Helio versions before 0.8.0 are affected when the dashboard sideband is in open mode. The dashboard sideband defaults to 127.0.0.1:3100.
What does an attacker need to exploit this issue?
An attacker can use a public DNS origin whose hostname begins with a private-network-looking prefix, such as 192.168.attacker.com, 10.evil.io, or 172.16.pwn.example. The vulnerable CORS validation can then echo that origin in Access-Control-Allow-Origin.
What is the remediation?
Upgrade Helio to version 0.8.0 or later, which patches the CORS origin validation.