CVE-2026-57111 Details
Description
Permissive Cross-Origin Resource Sharing (CORS) in the REST API (helix-rest, org.apache.helix.rest.server.filters.CORSFilter) in Apache Helix through 2.0.0 on all platforms allows a remote attacker controlling a web page visited by an authorized user to read responses from and issue cross-origin requests to administrative REST endpoints via a cross-origin request from an arbitrary origin, since the filter unconditionally returns Access-Control-Allow-Origin: * together with Access-Control-Allow-Credentials: true and reflects arbitrary Access-Control-Request-Method / Access-Control-Request-Headers values in preflight responses. Users are recommended to upgrade to version 2.0.1, which fixes this issue.
A Cross-Origin Resource Sharing (CORS) vulnerability has been identified in the Apache Helix REST API (helix-rest, org.apache.helix.rest.server.filters.CORSFilter) in all platforms through version 2.0.0. This vulnerability allows remote attackers, controlling a web page visited by an authorized user, to read responses from and send cross-origin requests to administrative REST endpoints. The issue arises because the CORS filter indiscriminately allows requests from any origin, permits credentials, and reflects arbitrary method and header values in preflight responses.
Users are advised to upgrade to Apache Helix version 2.0.1, which addresses this CORS vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/07/08/11 | CVE | Mailing ListThird Party Advisory |
| https://lists.apache.org/thread/wy2yv90lvqzx46vkg35xrtfddffq9cfj | [email protected] | Mailing ListVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1385 | Missing Origin Validation in WebSockets | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache helix | < 2.0.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | Initial Analysis | [email protected] |
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 9, 2026 | New CVE Received | [email protected] |
| Jul 9, 2026 | CVE Modified | CVE |