CVE-2026-65957 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
Helio is an MCP proxy that sits between AI agents and their tools. Before version 0.8.0, its dashboard accepted cross-origin requests from public domains whose names start with private-network prefixes, so a malicious web page can read responses from the local dashboard.
first public Jul 3, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running Helio before 0.8.0 with its dashboard sideband, which listens on 127.0.0.1:3100 by default. A victim's browser must visit an attacker page while Helio runs locally, so exposure depends on a developer's workstation or host running the proxy. Installations already on 0.8.0 or later are not affected.
Not affected if dashboard-disabled, version-0.8.0-or-later
Who cares ai-agents, helio, local-dev, mcp
0.8.0 are affected.127.0.0.1:3100, which the sources describe as the default bind.0.8.0 or later.Helio is an MCP proxy that sits between AI agents and the tools they use. Prior to version 0.8.0, the dashboard sideband (default 127.0.0.1:3100) validated CORS request origins by matching the hostname against a private-network string prefix (10., 172.16.–172.31., 192.168.) rather than validating an IP address. A public DNS name such as 192.168.attacker.com, 10.evil.io, or 172.16.pwn.example also satisfies that prefix, so the proxy echoed the attacker origin in Access-Control-Allow-Origin. This issue has been patched in version 0.8.0.
This page as .md ·
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.