CVE-2026-57111: Apache Helix CSRF Vulnerability

CVE-2026-57111 Overview

CVE-2026-57111 is a permissive Cross-Origin Resource Sharing (CORS) vulnerability in the Apache Helix REST API component helix-rest. The flaw resides in org.apache.helix.rest.server.filters.CORSFilter and affects Apache Helix versions through 2.0.0 on all platforms. The filter unconditionally returns Access-Control-Allow-Origin: * together with Access-Control-Allow-Credentials: true and reflects arbitrary Access-Control-Request-Method and Access-Control-Request-Headers values in preflight responses. A remote attacker who controls a web page visited by an authorized Helix user can issue cross-origin requests to administrative REST endpoints and read the responses. The vulnerability is classified under [CWE-1385] (Missing Origin Validation in WebSockets/CORS).

Critical Impact
Attackers can hijack authenticated sessions to invoke administrative Helix REST endpoints and exfiltrate cluster management data through victim browsers.

Affected Products

Apache Helix helix-rest component through version 2.0.0
org.apache.helix.rest.server.filters.CORSFilter in all deployed platforms
Any Helix cluster exposing the REST API to browser-accessible networks

Discovery Timeline

2026-07-09 - CVE-2026-57111 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-57111

Vulnerability Analysis

Apache Helix is a cluster management framework used to coordinate distributed and partitioned resources. The helix-rest module exposes administrative operations, including cluster configuration, resource assignment, and instance management, over HTTP. The CORSFilter class is responsible for handling preflight (OPTIONS) and simple cross-origin requests. In vulnerable releases, the filter applies an overly permissive policy that trusts every requesting origin while simultaneously allowing credentialed requests.

Because the filter returns Access-Control-Allow-Credentials: true along with a wildcard origin, browsers attach the user's session cookies and any bearer tokens to cross-origin requests. The filter additionally echoes back attacker-supplied values from Access-Control-Request-Method and Access-Control-Request-Headers, allowing preflight checks to pass for any method or header the attacker specifies.

Root Cause

The root cause is the unconditional CORS response header configuration in CORSFilter. The filter does not validate the Origin header against an allowlist, does not restrict credentialed requests, and reflects preflight metadata without evaluation. This combination violates the CORS specification, which prohibits pairing a wildcard Access-Control-Allow-Origin with Access-Control-Allow-Credentials: true.

Attack Vector

An attacker lures an authenticated Helix administrator to a malicious web page. The page issues JavaScript fetch or XMLHttpRequest calls to the Helix REST endpoints with credentials: 'include'. The victim's browser attaches cookies, the vulnerable filter approves the preflight, and the response is readable by attacker JavaScript. The attacker can enumerate clusters, modify resource states, or exfiltrate configuration data using the administrator's privileges.

The vulnerability requires no code execution on the server and no direct network access to the REST API from the attacker. Any browser session established by an authorized user is sufficient. See the Apache Security Mailing List Thread and the Openwall OSS Security Discussion for the vendor announcement.

Detection Methods for CVE-2026-57111

Indicators of Compromise

HTTP request logs on helix-rest showing Origin headers from domains outside the organization's allowlist paired with successful 200 responses.
Preflight OPTIONS requests containing unusual Access-Control-Request-Headers values followed by state-changing POST, PUT, or DELETE calls from the same session.
Administrative REST actions originating from browser user agents rather than known automation tooling or service accounts.

Detection Strategies

Inspect helix-rest access logs for cross-origin requests referencing sensitive endpoints such as /clusters, /instances, or /resources.
Deploy web application firewall rules that flag responses carrying both Access-Control-Allow-Origin: * and Access-Control-Allow-Credentials: true.
Correlate administrator browser sessions with unexpected REST API traffic patterns to detect CSRF-style abuse of the CORS weakness.

Monitoring Recommendations

Forward helix-rest HTTP logs to a centralized analytics platform and alert on non-allowlisted Origin values.
Monitor for spikes in OPTIONS requests immediately followed by mutating verbs on administrative paths.
Track version metadata for all Helix deployments to identify hosts still running 2.0.0 or earlier.

How to Mitigate CVE-2026-57111

Immediate Actions Required

Upgrade all Apache Helix installations to version 2.0.1, which corrects the CORS filter behavior.
Restrict network exposure of helix-rest so that only trusted administrative subnets can reach the API.
Invalidate active administrative sessions and rotate any credentials that may have been used through a browser during the exposure window.

Patch Information

Apache has released Apache Helix 2.0.1 with a corrected CORSFilter implementation. Users are recommended to upgrade to 2.0.1 per the vendor advisory. Refer to the Apache Security Mailing List Thread for release details.

Workarounds

Place helix-rest behind a reverse proxy that strips or overrides CORS response headers with a strict origin allowlist.
Disable Access-Control-Allow-Credentials at the proxy layer if wildcard origins must remain, breaking the credentialed cross-origin attack path.
Require administrators to use dedicated browser profiles or isolated management workstations that cannot visit untrusted websites while authenticated to Helix.

bash

# Example nginx reverse proxy override enforcing a strict CORS policy
location /helix-rest/ {
    proxy_pass http://helix-backend/;

    # Remove permissive headers from upstream
    proxy_hide_header Access-Control-Allow-Origin;
    proxy_hide_header Access-Control-Allow-Credentials;

    # Apply strict allowlist
    if ($http_origin ~* ^https://admin\.example\.com$) {
        add_header Access-Control-Allow-Origin $http_origin always;
        add_header Access-Control-Allow-Credentials true always;
    }
}