CVE-2026-100858heym before 0.0.109 Server-Side Request Forgery via Workflow Nodes
Updated under an hour ago ()
Does this affect you?
It affects heymrun heym. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
heym before 0.0.109 contains a server-side request forgery vulnerability in the Slack, Discord, and Crawler workflow nodes. These nodes issue HTTP requests to URLs taken from user-created credentials (webhook_url / flaresolverr_url) using an unguarded HTTP client, bypassing the SSRF egress guard that already protects the HTTP, WebSocket, and MCP nodes; the credential API validates only that the URL is non-empty. Any registered user can create a credential pointing at an internal address and execute a workflow, causing the backend to reach loopback, private, link-local, or cloud-metadata endpoints and return the full response body in the node output (non-blind SSRF).
- CVSS
- 6.8 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
- Weakness (CWE)
- CWE-918
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- VulnCheck
- NVD analysis
- Deferred
- Record last updated
- Sep 30, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
heymrun heym heymrun:heym (from the name) | before 0.0.109; 0.0.109 not affected | CNA record |
References
- https://github.com/heymrun/heym/security/advisories/GHSA-39j3-6x3x-8rcrvendor-advisory
- https://www.vulncheck.com/advisories/heym-before-0.0.109-server-side-request-forgery-via-workflow-nodesthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.