CVE-2026-65957

Helio is an MCP proxy that sits between AI agents and the tools they use. Prior to version 0.8.0, the dashboard sideband default 127.0.0.1:3100 validated CORS request origins by matching the hostname against a private-network string prefix 10., 172.16.–172.31., 192.168. rather than validating an ...

CVE-2026-65957

The Helio MCP proxy (prior to version 0.8.0 ) contains a CORS origin validation error in its dashboard sideband (defaulting to 127.0.0.1:3100). The software incorrectly validated request origins by matching hostnames against private-network string prefixes (e.g., 10., 172.16.-172.31., 192.168.) i...

CVE-2026-65957 Helio: Dashboard sideband CORS origin allowlist matches hostnames by prefix, admitting attacker-controlled origins in open mode

Helio is an MCP proxy that sits between AI agents and the tools they use. Prior to version 0.8.0, the dashboard sideband default 127.0.0.1:3100 validated CORS request origins by matching the hostname against a private-network string prefix 10., 172.16.–172.31., 192.168. rather than validating an ...

CVE-2026-65957

Helio is an MCP proxy that sits between AI agents and the tools they use. Prior to version 0.8.0, the dashboard sideband default 127.0.0.1:3100 validated CORS request origins by matching the hostname against a private-network string prefix 10., 172.16.–172.31., 192.168. rather than validating an ...

EUVD-2026-124010

Helio is an MCP proxy that sits between AI agents and the tools they use. Prior to version 0.8.0, the dashboard sideband default 127.0.0.1:3100 validated CORS request origins by matching the hostname against a private-network string prefix 10., 172.16.–172.31., 192.168. rather than validating an ...

CVE-2026-65957: gethelio helio: Helio is an MCP proxy that sits between AI agents and the tools they use

Helio is an MCP proxy that sits between AI agents and the tools they use. Prior to version 0.8.0, the dashboard sideband default 127.0.0.1:3100 validated CORS request origins by matching the hostname against a private-network string prefix 10., 172.16.–172.31., 192.168. rather than validating an ...

PT-2026-145475

Helio is an MCP proxy that sits between AI agents and the tools they use. Prior to version 0.8.0, the dashboard sideband default 127.0.0.1:3100 validated CORS request origins by matching the hostname against a private-network string prefix 10., 172.16.–172.31., 192.168. rather than validating an ...

cc.alans.netty-plus:netty-plus (1.0.0), cc.uncarbon.framework:helio-starter-rate-limit-redis (>=2.3.0, <=2.4.1) +827 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (>=3.4.0, <=3.4.13)

org.springframework.data:spring-data-keyvalue MAVEN version =3.4.0, =2.3.0, =2.3.0, =2.3.0, =0.0.1, =1.7.0.v3, =5.0.5, =3.2.5, =4.1.3 and more Source cves: CVE-2026-41719 Source advisory: GHSA-XG2J-3HJ6-PC24...

cc.uncarbon.framework:helio-starter-cloud (>=1.2.1, <=1.3.0), com.alibaba.nacos:nacos-client (>=2.0.0-alpha.1, <=2.0.0-beta) potentially affected by CVE-2021-44667 via com.alibaba.nacos:nacos-common (>=2.0.0-alpha.1, <=2.0.0-beta)

com.alibaba.nacos:nacos-common MAVEN version =2.0.0-alpha.1, =1.2.1, =2.0.0-alpha.1, =2.0.0-beta Source cves: CVE-2021-44667 Source advisory: MEND:CVE-2021-44667...