heym before 0.0.105 fails to apply egress guards to integration services that use credential-supplied base URLs, allowing authenticated users to… (CVE-2026-100861)
A vulnerability in heym versions before 0.0.105 allows authenticated users to bypass server-side request forgery (SSRF) protections. This occurs because egress guards are not applied to integration services that use credential-supplied base URLs. Attackers can exploit this by configuring credentials to point to loopback, private, or cloud-metadata addresses, enabling them to read internal service responses as workflow node output.
AI Analysis
Technical Summary
The heym software prior to version 0.0.105 fails to enforce egress guards on integration services when the base URLs are supplied via credentials. This flaw permits authenticated users to circumvent SSRF protections by setting credentials that reference internal network addresses such as loopback, private IP ranges, or cloud metadata endpoints. Consequently, attackers can retrieve internal service responses which are exposed as outputs in workflow nodes.
Potential Impact
Authenticated users can bypass SSRF protections and access internal services that should be restricted. This may lead to unauthorized disclosure of sensitive internal information via workflow node outputs. The vulnerability does not impact confidentiality beyond information disclosure, nor does it affect integrity or availability directly.
Mitigation Recommendations
A fix is available in heym version 0.0.105 that addresses this issue by applying egress guards correctly. Users should upgrade to version 0.0.105 or later to remediate the vulnerability. No additional mitigation guidance is provided or required beyond applying the official fix.
heym before 0.0.105 fails to apply egress guards to integration services that use credential-supplied base URLs, allowing authenticated users to… (CVE-2026-100861)
Description
A vulnerability in heym versions before 0.0.105 allows authenticated users to bypass server-side request forgery (SSRF) protections. This occurs because egress guards are not applied to integration services that use credential-supplied base URLs. Attackers can exploit this by configuring credentials to point to loopback, private, or cloud-metadata addresses, enabling them to read internal service responses as workflow node output.
CVSS v3.1
Score 5.0medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The heym software prior to version 0.0.105 fails to enforce egress guards on integration services when the base URLs are supplied via credentials. This flaw permits authenticated users to circumvent SSRF protections by setting credentials that reference internal network addresses such as loopback, private IP ranges, or cloud metadata endpoints. Consequently, attackers can retrieve internal service responses which are exposed as outputs in workflow nodes.
Potential Impact
Authenticated users can bypass SSRF protections and access internal services that should be restricted. This may lead to unauthorized disclosure of sensitive internal information via workflow node outputs. The vulnerability does not impact confidentiality beyond information disclosure, nor does it affect integrity or availability directly.
Mitigation Recommendations
A fix is available in heym version 0.0.105 that addresses this issue by applying egress guards correctly. Users should upgrade to version 0.0.105 or later to remediate the vulnerability. No additional mitigation guidance is provided or required beyond applying the official fix.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-77h5-29x8-rvxj
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-100861"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6ab89bbcf7a7c54106941ea8
Added to database: 09/27/2026, 04:29:48 UTC
Last enriched: 09/27/2026, 04:35:21 UTC
Last updated: 09/27/2026, 05:17:41 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.