Executive brief
Apache Helix is a cluster management framework used to manage distributed systems. A security flaw in its REST API component allows a malicious website to interact with the Helix administrative interface if an authorized user visits that website. This could allow an attacker to read sensitive configuration data or issue unauthorized administrative commands, potentially compromising the management of the distributed cluster.
Technical details
A permissive Cross-Origin Resource Sharing (CORS) vulnerability exists in the 'helix-rest' component (specifically org.apache.helix.rest.server.filters.CORSFilter) of Apache Helix. The filter incorrectly implements CORS by unconditionally returning 'Access-Control-Allow-Origin: *' in conjunction with 'Access-Control-Allow-Credentials: true'. Additionally, it reflects arbitrary values from 'Access-Control-Request-Method' and 'Access-Control-Request-Headers' in preflight responses. An attacker who convinces an authenticated user to visit a malicious web page can leverage these misconfigurations to perform cross-origin requests to administrative REST endpoints and read the resulting responses. This issue is resolved in version 2.0.1.
Affected products
- Apache Software Foundation Apache Helix REST 0 through 2.0.0
Timeline
- 2026-07-08: disclosed: Initial disclosure on oss-security mailing list
- 2026-07-09: advisory: NVD publication date