CVE-2026-57111
Apache Helix ≤ 2.0.1
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2026-57111 is a high-severity Missing Origin Validation in WebSockets (CWE-1385) vulnerability in Apache Helix. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and SC-7 (Boundary Protection) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-42529
Vulnerability Data
Permissive Cross-Origin Resource Sharing (CORS) in the REST API (helix-rest, org.apache.helix.rest.server.filters.CORSFilter) in Apache Helix through 2.0.0 on all platforms allows a remote attacker controlling a web page visited by an authorized user to read responses from and issue cross-origin requests…
more
to administrative REST endpoints via a cross-origin request from an arbitrary origin, since the filter unconditionally returns Access-Control-Allow-Origin: * together with Access-Control-Allow-Credentials: true and reflects arbitrary Access-Control-Request-Method / Access-Control-Request-Headers values in preflight responses. Users are recommended to upgrade to version 2.0.1, which fixes this issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Permissive CORS misconfiguration (CWE-1385) in a public REST API directly enables exploitation of a public-facing administrative interface (T1190), allowing unauthorized cross-origin access to sensitive endpoints.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Boundary protection at the REST API layer can enforce origin allow-lists and block the permissive CORSFilter that returns Access-Control-Allow-Origin: * with credentials.
Information flow enforcement can restrict cross-origin data flows from untrusted origins to the administrative REST endpoints, directly mitigating the reflected CORS policy.
Input validation on CORS preflight headers can reject or sanitize arbitrary Access-Control-Request-Method / Access-Control-Request-Headers values before they are reflected.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require origin validation for WebSocket endpoints.
Origin validation is a required step when authenticating WebSocket connection requests.
Enforcing authorization policy on incoming connections can require origin checks.
Network-level controls that block unauthorized logical access can mitigate missing origin checks.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect missing origin validation in WebSocket implementations.
Network security controls can enforce origin validation and restrict WebSocket connections to trusted sources.
Secure configuration of network services can include origin checks for WebSocket endpoints.
Application security requirements can mandate origin validation for WebSocket communications.
Secure architecture principles can require proper origin validation mechanisms in WebSocket implementations.
Secure coding standards can explicitly require origin validation for WebSocket connections.