Apache Helix security advisories

Security information for Apache Helix

Reporting

Do you want disclose a potential security issue for Apache Helix? Send your report to the Apache Security Team.

Advisories

This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public mailinglist or privately on security@apache.org

Permissive CORS Configuration in REST API Allows Unrestricted Cross-Origin

CVE-2026-57111 [CVE] [CVE json] [OSV json]

Last updated: 2026-07-09T07:08:43.930Z

Affected

Apache Helix REST through 2.0.0

Description

Permissive Cross-Origin Resource Sharing (CORS) in the REST API (helix-rest, org.apache.helix.rest.server.filters.CORSFilter) in Apache Helix through 2.0.0 on all platforms allows a remote attacker controlling a web page visited by an authorized user to read responses from and issue cross-origin requests to administrative REST endpoints via a cross-origin request from an arbitrary origin, since the filter unconditionally returns Access-Control-Allow-Origin: * together with Access-Control-Allow-Credentials: true and reflects arbitrary Access-Control-Request-Method / Access-Control-Request-Headers values in preflight responses. Users are recommended to upgrade to version 2.0.1, which fixes this issue.

References

https://lists.apache.org/thread/wy2yv90lvqzx46vkg35xrtfddffq9cfj

Credits

Aastha Aggarwal (https://github.com/Aastha2602) (reporter)

Helix front hard-coded secret in the express-session

CVE-2024-22281 [CVE] [CVE json] [OSV json]

Last updated: 2024-08-20T22:11:36.792Z

Affected

Apache Helix Front (UI) through *

Description

** UNSUPPORTED WHEN ASSIGNED ** The Apache Helix Front (UI) component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their own fake cookies.

This issue affects Apache Helix Front (UI): all versions.

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

References

https://lists.apache.org/thread/zt26fpmrqx3fzcy8nv3b43kb3xllo5ny

Credits

Jonathan Leitschuh (finder)

Deserialization vulnerability in Helix workflow and REST

CVE-2023-38647 [CVE] [CVE json] [OSV json]

Last updated: 2023-07-26T07:52:23.420Z

Affected

Apache Helix through 1.2.0

Description

An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remote code execution. The code can be run in Helix REST start and Workflow creation.

Affect all the versions lower and include 1.2.0.

Affected products: helix-core, helix-rest

Mitigation: Short term, stop using any YAML based configuration and workflow creation.
Long term, all Helix version bumping up to 1.3.0