CVE-2026-57111

Name of the Vulnerable Software and Affected Versions Apache Helix versions prior to 2.0.1

Description Permissive Cross-Origin Resource Sharing (CORS) in the REST API (helix-rest, org.apache.helix.rest.server.filters.CORSFilter) allows a remote attacker controlling a web page visited by an authorized user to read responses from and issue cross-origin requests to administrative REST endpoints. This occurs because the filter unconditionally returns Access-Control-Allow-Origin: * combined with Access-Control-Allow-Credentials: true and reflects arbitrary Access-Control-Request-Method and Access-Control-Request-Headers values in preflight responses. CORS is a mechanism that allows restricted resources on a web page to be requested from another domain outside the domain from which the first resource was served.

Recommendations Upgrade to version 2.0.1.