{"id":"CVE-2026-65957","kind":"vulnerability","aliases":["CVE-2026-65957"],"related":[],"title":"Helio MCP proxy: CORS check lets attacker websites reach dashboard","description":"Helio is an MCP proxy that sits between AI agents and the tools they use. Prior to version 0.8.0, the dashboard sideband (default 127.0.0.1:3100) validated CORS request origins by matching the hostname against a private-network string prefix (10., 172.16.–172.31., 192.168.) rather than validating an IP address. A public DNS name such as 192.168.attacker.com, 10.evil.io, or 172.16.pwn.example also satisfies that prefix, so the proxy echoed the attacker origin in Access-Control-Allow-Origin. This issue has been patched in version 0.8.0.","summary":"Helio is an MCP proxy that sits between AI agents and their tools. Before version 0.8.0, its dashboard accepted cross-origin requests from public domains whose names start with private-network prefixes, so a malicious web page can read responses from the local dashboard.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","helio","local-dev","mcp"],"not_affected_if":["dashboard-disabled","version-0.8.0-or-later"],"how_to_check":"- Check the installed Helio version; versions below `0.8.0` are affected.\n- Check whether the dashboard sideband is reachable on its default `127.0.0.1:3100`, which the sources describe as the default bind.","fix":"- Helio: move to `0.8.0` or later.","status":"open","published_at":"2026-11-11T21:16:46+00:00","first_seen_at":"2026-11-11T21:29:09+00:00","triaged_at":"2026-11-11T21:30:51+00:00","updated_at":"2026-11-11T21:30:51+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-11T21:30:51Z","model":"claude-haiku-5-5","output":{"fix":"- Helio: move to `0.8.0` or later.","reach":"local","title":"Helio MCP proxy: CORS check lets attacker websites reach dashboard","impact":"medium","summary":"Helio is an MCP proxy that sits between AI agents and their tools. Before version 0.8.0, its dashboard accepted cross-origin requests from public domains whose names start with private-network prefixes, so a malicious web page can read responses from the local dashboard.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["helio","mcp","ai-agents","local-dev"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker page reads local Helio dashboard responses via CORS","analyst_note":"","how_to_check":"- Check the installed Helio version; versions below `0.8.0` are affected.\n- Check whether the dashboard sideband is reachable on its default `127.0.0.1:3100`, which the sources describe as the default bind.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-0.8.0-or-later","dashboard-disabled"],"who_is_affected":"Teams running Helio before 0.8.0 with its dashboard sideband, which listens on 127.0.0.1:3100 by default. A victim's browser must visit an attacker page while Helio runs locally, so exposure depends on a developer's workstation or host running the proxy. Installations already on 0.8.0 or later are not affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000746,"input_tokens":4689,"output_tokens":555,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-65957':13A,16A '0.8.0':43B,92C,158C '10':114C '10.evil.io':131C '127.0.0.1':97C '172.16':115C '172.16.pwn.example':133C '172.31':116C '192.168':117C '192.168.attacker.com':130C '3100':98C 'accept':46B 'access':147C 'access-control-allow-origin':146C 'address':123C 'agent':19B,37B,83C 'ai':18B,21B,36B,82C 'ai-ag':17B 'ai-tool':20B 'allow':149C 'also':134C 'attack':7A,143C 'check':5A 'control':148C 'cor':4A,100C 'cross':48B 'cross-origin':47B 'cve':11A,14A 'dashboard':10A,45B,73B,94C 'default':96C 'dev':26B 'dns':126C 'domain':53B 'echo':141C 'helio':1A,23B,28B,74C 'hostnam':106C 'ip':122C 'issu':152C 'let':6A 'local':25B,72B 'local-dev':24B 'malici':64B 'match':104C 'mcp':2A,27B,31B,77C 'name':55B,127C 'network':60B,111C 'origin':49B,102C,144C,150C 'page':66B 'patch':155C 'prefix':61B,113C,137C 'prior':89C 'privat':59B,110C 'private-network':58B,109C 'proxi':3A,32B,78C,140C 'public':52B,125C 'rather':118C 'reach':9A 'read':68B 'request':50B,101C 'respons':69B 'satisfi':135C 'sideband':95C 'sit':34B,80C 'start':56B 'string':112C 'tool':22B,40B,86C 'use':88C 'valid':99C,120C 'version':42B,91C,157C 'web':65B 'websit':8A 'whose':54B","nicknames":[],"mitigations":[],"who_affected":"Teams running Helio before 0.8.0 with its dashboard sideband, which listens on 127.0.0.1:3100 by default. A victim's browser must visit an attacker page while Helio runs locally, so exposure depends on a developer's workstation or host running the proxy. Installations already on 0.8.0 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aiagents","aitooling","helio","localdev","mcp","medium"],"campaign_type":null,"search_a":"'-2026':12A,15A '-65957':13A,16A 'attack':7A 'check':5A 'cor':4A 'cve':11A,14A 'dashboard':10A 'helio':1A 'let':6A 'mcp':2A 'proxi':3A 'reach':9A 'websit':8A","search_b":"'0.8.0':43B 'accept':46B 'agent':19B,37B 'ai':18B,21B,36B 'ai-ag':17B 'ai-tool':20B 'cross':48B 'cross-origin':47B 'dashboard':45B,73B 'dev':26B 'domain':53B 'helio':23B,28B 'local':25B,72B 'local-dev':24B 'malici':64B 'mcp':27B,31B 'name':55B 'network':60B 'origin':49B 'page':66B 'prefix':61B 'privat':59B 'private-network':58B 'proxi':32B 'public':52B 'read':68B 'request':50B 'respons':69B 'sit':34B 'start':56B 'tool':22B,40B 'version':42B 'web':65B 'whose':54B","search_c":"'0.8.0':92C,158C '10':114C '10.evil.io':131C '127.0.0.1':97C '172.16':115C '172.16.pwn.example':133C '172.31':116C '192.168':117C '192.168.attacker.com':130C '3100':98C 'access':147C 'access-control-allow-origin':146C 'address':123C 'agent':83C 'ai':82C 'allow':149C 'also':134C 'attack':143C 'control':148C 'cor':100C 'dashboard':94C 'default':96C 'dns':126C 'echo':141C 'helio':74C 'hostnam':106C 'ip':122C 'issu':152C 'match':104C 'mcp':77C 'name':127C 'network':111C 'origin':102C,144C,150C 'patch':155C 'prefix':113C,137C 'prior':89C 'privat':110C 'private-network':109C 'proxi':78C,140C 'public':125C 'rather':118C 'request':101C 'satisfi':135C 'sideband':95C 'sit':80C 'string':112C 'tool':86C 'use':88C 'valid':99C,120C 'version':91C,157C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-03T15:59:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65957","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65957","severity":null,"published_at":"2026-11-11T21:16:46+00:00","modified_at":"2026-11-11T21:16:46+00:00","first_seen_at":"2026-11-11T21:29:09+00:00","fetched_at":"2026-11-11T21:29:09+00:00","note":null}],"documents":[{"id":129006,"url":"https://github.com/gethelio/helio/commit/4ca8329c38b0edbc5e4d782a4e3b0cfc5cd7782e","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":129007,"url":"https://github.com/gethelio/helio/releases/tag/v0.8.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":129008,"url":"https://github.com/gethelio/helio/security/advisories/GHSA-2c3r-q7gv-hp2m","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-03T15:59:52+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}