CORS Misconfiguration in Helio MCP Proxy by GetHelio

CVE-2026-65957

What is CVE-2026-65957?

The Helio MCP Proxy, developed by GetHelio, is vulnerable to a CORS misconfiguration issue present in versions prior to 0.8.0. This vulnerability arises from the proxy's method of validating CORS request origins, which only checks the hostname against a predefined private network string prefix. Consequently, legitimate requests could be inadvertently accepted from malicious public DNS names that match these criteria, allowing attackers to exploit the Access-Control-Allow-Origin header. This flaw poses a risk of unauthorized cross-origin interactions, which could lead to sensitive data exposure and further exploitation. The vulnerability has been effectively mitigated in version 0.8.0.

References