Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-100860— heym before 0.0.105 Authentication Bypass via Redis Node

Quick assessment

Affected
heymrun heym
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 heym 版本低于 0.0.105 时，Redis 工作流节点（位于 backend/app/services/node_execution/nodes/redis_node.py）在处理凭据授权查找结果时存在行为缺陷。当函数 返回 （即因为凭据 ID 不存在，或调用者无权使用该凭据）时，该节点会将此次查找失败视为配置为空，从而回退到默认设置：以无密码方式连接至 localhost:6379，并在该 Redis 实例上执行所请求的操作。 此外，如果可用的凭据其配置为空，或缺少 字段，也会触发相同的回退行为。 因

CVSS 5.5 · Medium EPSS 0.11% · P1
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-100860

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
heym before 0.0.105 Authentication Bypass via Redis Node
Source: CVE Program / CVE List V5
Vulnerability Description
heym before 0.0.105 does not act on the result of the credential authorization lookup in the Redis workflow node (backend/app/services/node_execution/nodes/redis_node.py). When _get_accessible_credential returns None — because the credential ID does not exist or the caller is not authorized to use it — the node treats the lookup failure as an empty configuration and falls back to defaults, connecting to localhost:6379 with no password and executing the requested operation there. The same fallback occurs when an accessible credential has an empty config or no redis_host value. An authenticated workflow author who supplies a credential ID they do not own, or one that was deleted, therefore obtains a read/write connection to whatever Redis is listening on the backend's loopback interface instead of an error. Impact depends on the deployment: the stock docker-compose.yml ships no Redis, in which case the flaw surfaces as a misleading connection error rather than data exposure.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
未能安全地进行程序失效(Failing Open)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
heymrun heym 0 ~ 0.0.105 -

II. Public POCs for CVE-2026-100860

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-100860

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-100860 (1)

Other References for CVE-2026-100860 (1)

Same Patch Batch · heymrun · 2026-09-27 · 10 CVEs total

CVE-2026-100864 8.8 HIGH heym before 0.0.91 Remote Code Execution via Expression Engine
CVE-2026-100865 8.8 HIGH Heym before 0.0.53 Remote Code Execution via eval() Sandbox Escape
CVE-2026-100858 6.8 MEDIUM heym before 0.0.109 Server-Side Request Forgery via Workflow Nodes
CVE-2026-101050 6.5 MEDIUM Heym before 0.0.53 Authentication Bypass via Telegram Webhook
CVE-2026-101049 6.5 MEDIUM Heym before 0.0.53 Slack Webhook Signature Verification Bypass
CVE-2026-100859 6.5 MEDIUM Heym before 0.0.106 Credential Exfiltration via URL Override
CVE-2026-100861 5.0 MEDIUM heym before 0.0.105 SSRF via credential-controlled base URLs
CVE-2026-100863 5.0 MEDIUM Heym before 0.0.91 SSRF via image fetching and IPv6 validation
CVE-2026-100862 4.9 MEDIUM heym before 0.0.91 Multiple Secrets Plaintext Storage

IV. Related Vulnerabilities

Same product: heym
Same vendor: heymrun
Same weakness: CWE-636

V. Comments for CVE-2026-100860

No comments yet

Leave a comment