Threats tagged 'ghsa-v44j-74xg-9j2q'

heym versions before 0.0.105 have a vulnerability in the Redis workflow node where the system does not properly handle failed credential authorization lookups. Instead of returning an error when a credential ID is invalid or unauthorized, the node falls back to connecting to Redis on localhost:6379 without authentication. This can allow an authenticated workflow author to gain unintended read/write access to a local Redis instance if one is running. The impact varies depending on deployment; for example, the default docker-compose setup does not include Redis, resulting only in misleading connection errors rather than data exposure.