CVE-2026-65957

A browser origin could pass Helio's local dashboard trust check

Helio maintainers · Helio MCP proxy dashboard

First documented disclosure · Review checkpoint

Summary

The dashboard treated a hostname resembling a private address as a trusted origin. An untrusted origin could interact with the dashboard's sideband interface.

Severity and exploitation evidence

Medium · 6.9/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The dashboard treated a hostname resembling a private address as a trusted origin.

Conditions required

A browser could reach a dashboard using its affected open-mode origin policy.

Potential impact

An untrusted origin could interact with the dashboard's sideband interface.

Affected versions and configurations

Before 0.8.0.

Fix and mitigation status

0.8.0.

Practical next steps

Upgrade Helio and verify dashboard origin restrictions.

Operating lesson

Check the authority granted to the affected component against the operation a user expects.

Evidence and limits

The public disclosure was on 2026-07-03. The CVE record was published on 2026-11-11.

Sources