Read the docs
TI-2023-20004 Aliases CVE-2023-38647GHSA-jhcr-hph9-g7wm

Apache Helix: Deserialization vulnerability in Helix workflow and REST

Priority MEDIUM 53CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remote code execution. The code can be run in Helix REST start and Workflow creation. Affect all the versions lower and include 1.2.0. Affected products: helix-core, helix-rest Mitigation: Short term, stop using any YAML based configuration and workflow creation.                   Long term, all Helix version bumping up to 1.3.0

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01953 80th percentileScored 2026-11-07
Fix Fixed org.apache.helix:helix-core (Maven): 1.3.0org.apache.helix:helix-rest (Maven): 1.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Helixup to 1.2.0—No fix listedCNA
—org.apache.helix:helix-core (Maven)before 1.3.01.3.0Patch availableGHSA-jhcr-hph9-g7wm
—org.apache.helix:helix-rest (Maven)before 1.3.01.3.0Patch availableGHSA-jhcr-hph9-g7wm
  • Apache Helix VendorApache Affected up to 1.2.0 Fixed in — No fix listed CNA
  • org.apache.helix:helix-core (Maven) Vendor— Affected before 1.3.0 Fixed in 1.3.0 Patch available GHSA-jhcr-hph9-g7wm
  • org.apache.helix:helix-rest (Maven) Vendor— Affected before 1.3.0 Fixed in 1.3.0 Patch available GHSA-jhcr-hph9-g7wm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:helix:*:*:*:*:*:*:*:*before 1.3.0VulnerableApache
  • cpe:2.3:a:apache:helix:*:*:*:*:*:*:*:* Versions before 1.3.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-jhcr-hph9-g7wm org.apache.helix:helix-core (Maven) Fixed in 1.3.0 Advisory →
  • Fix · GHSA-jhcr-hph9-g7wm org.apache.helix:helix-rest (Maven) Fixed in 1.3.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-38647
  2. 2026-10-03 Alias added: GHSA-jhcr-hph9-g7wm

References

Advisory 2

Other 2

  • TI-2024-14868 Apache Helix Front (UI): Helix front hard-coded secret in the express-session CVSS 3.1HIGH 7.5
  • TI-2026-41096 Apache Helix REST: Permissive CORS Configuration in REST API Allows Unrestricted Cross-Origin CVSS 3.1HIGH 7.5
  • TI-2022-23577 Apache Helix: Open redirect CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences