diff --git a/binderhub/base.py b/binderhub/base.py
index b21bfdb5b..33d7df0ff 100644
--- a/binderhub/base.py
+++ b/binderhub/base.py
@@ -216,6 +216,13 @@ class VersionHandler(BaseHandler):
     # (e.g. mybinder.org federation when blocking cloud datacenters)
     skip_check_request_ip = True
 
+    def set_default_headers(self):
+        if "Access-Control-Allow-Origin" not in self.settings.get("headers", {}):
+            # allow CORS requests to this endpoint by default
+            self.set_header("Access-Control-Allow-Origin", "*")
+
+        super().set_default_headers()
+
     async def get(self):
         self.set_header("Content-type", "application/json")
         r = {