CVE-2026-84207: Server-Side Request Forgery (SSRF) in heymrun heym

Heym versions prior to 0.0.98 do not enforce SSRF egress protections on WebSocket Send and WebSocket Trigger nodes. Authenticated users can exploit this by creating workflow nodes that specify arbitrary URLs and headers, thereby reaching internal services that would normally be inaccessible. Responses from these internal services can be read via the WebSocket Trigger node, potentially exposing sensitive internal information. No official remediation or patch information is provided in the available data.

Authenticated users can leverage this vulnerability to perform SSRF attacks that bypass egress restrictions on WebSocket nodes. This enables them to connect to and read responses from internal services, which may lead to unauthorized information disclosure within the internal network. There is no indication of remote unauthenticated exploitation or privilege escalation beyond the requirement of authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected versions and limit authenticated user permissions to prevent exploitation. Monitor for updates from the vendor regarding patches or official mitigations.