In heym versions prior to 0.0.105, the Redis workflow node fails to act on the result of credential authorization lookups. When the lookup returns None—due to a missing credential ID or lack of authorization—the node treats this as an empty configuration and defaults to connecting to Redis on localhost:6379 without authentication. This fallback also occurs if the accessible credential has an empty configuration or lacks a redis_host value. Consequently, an authenticated workflow author can supply a credential ID they do not own or that was deleted and gain read/write access to the Redis instance listening on the backend's loopback interface. The severity of this issue depends on the deployment environment; for example, the default docker-compose.yml setup does not include Redis, causing a connection error rather than unauthorized access.

An authenticated workflow author can potentially gain unauthorized read/write access to a Redis instance running on the backend's localhost interface by exploiting the fallback behavior when credential authorization fails. This could lead to unauthorized data access or manipulation if Redis is present and accessible. If Redis is not deployed locally, the impact is limited to misleading connection errors without data exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid deploying heym in environments where a local Redis instance is accessible on the loopback interface, or restrict access to Redis accordingly. Monitor vendor communications for official patches or updates addressing this issue.