CVE-2026-84207
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes, allowing authenticated users to connect to internal services. Attackers can craft workflow nodes with arbitrary URLs and headers to reach internal services and read responses from the WebSocket Trigger node.
Risk Assessment
The risk includes the ability to scan and attack internal services, potentially leading to data confidentiality breaches, privilege escalation, or system disruption.
Recommendation
Update Heym to version 0.0.98 or later, which includes a fix for the SSRF vulnerability, and implement egress rules to restrict outbound traffic to internal addresses.
Other vulnerabilities in Heym
See all- CVE-2026-45227High
Heym before version 0.0.21 contains a sandbox escape vulnerability in the custom Python tool executor. Authenticated workflow authors can bypass sandbox restrictions using object-graph introspection primitives.
- CVE-2026-45226High
Heym before version 0.0.21 contains an authorization bypass vulnerability in workflow execution. An authenticated attacker can execute arbitrary workflows by referencing victim workflow UUIDs without proper access validation.
- CVE-2026-45225High
A path traversal vulnerability in Heym before version 0.0.21 allows authenticated users to write attacker-controlled files to arbitrary locations by supplying a crafted filename with traversal sequences. The flaw exists in the file upload endpoint where the filename parameter is not properly validated.
Original NVD description (English source)
Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes, allowing authenticated users to connect to internal services. Attackers can craft workflow nodes with arbitrary URLs and headers to reach internal services and read responses from the WebSocket Trigger node.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS