Apache Helix vulnerabilities

4 CVEs affecting Apache Helix, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-57111, published 2026-07-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-38647, published 2023-07-26. Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days. An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that…
CVE-2022-47500, published 2022-12-19. Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days. URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Software Foundation Apache Helix UI component.This issue affects Apache Helix all releases from 0.8.0 to…
CVE-2024-22281, published 2024-08-20. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. ** UNSUPPORTED WHEN ASSIGNED ** The Apache Helix Front (UI) component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their own fake cookies. This issue affects…
CVE-2026-57111, published 2026-07-09. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Permissive Cross-Origin Resource Sharing (CORS) in the REST API (helix-rest, org.apache.helix.rest.server.filters.CORSFilter) in Apache Helix through 2.0.0 on all platforms allows a remote attacker…