CVE-2026-100861GHSA-xchj-mw74-2232
heym before 0.0.105 SSRF via credential-controlled base URLs
heymrun heym
CVSS
5.3MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 28 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 0.0.105heymCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
heym before 0.0.105 fails to apply egress guards to integration services that use credential-supplied base URLs, allowing authenticated users to bypass SSRF protections. Attackers can configure credentials pointing to loopback, private, or cloud-metadata addresses and read internal service responses returned as workflow node output.
Text from CVE List
Affected versions 2
- heymaffected: all versions before 0.0.105CVE List
- heymunaffected: 0.0.105CVE List