Helix vulnerabilities

3 known vulnerabilities in Helix from Apache. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Apache Helix REST: Missing Origin Validation in WebSockets

  CVE-2026-57111Jul 9, 2026Apache

  Permissive Cross-Origin Resource Sharing (CORS) in the REST API (helix-rest, org.apache.helix.rest.server.filters.CORSFilter) in Apache Helix through 2.0.0 on all platforms allows a remote attacker controlling a web page visited by an authorized user to read r

• 7.5 High severity

  Apache Helix Front (UI): Exposure of Resource to Wrong Sphere

  CVE-2024-22281Aug 20, 2024Apache

  ** UNSUPPORTED WHEN ASSIGNED ** The Apache Helix Front (UI) component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their own fake cookies. This issue affects Apache Helix Front (UI): all versions. As this project is retir

• 9.8 Critical severity

  Apache Helix: Deserialization of Untrusted Data

  CVE-2023-38647Jul 26, 2023ApacheEPSS 1.95%

  An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remot