Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-100861— heym before 0.0.105 SSRF via credential-controlled base URLs

Quick assessment

Affected
heymrun heym
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 heym 版本小于 0.0.105 时，系统未能为使用凭据提供的基础 URL 的集成服务应用出口（egress）防护规则，导致经过身份验证的用户可以绕过服务器端请求伪造（SSRF）的保护机制。攻击者可以配置指向回环地址（loopback）、私有网络地址或云元数据地址的凭据，从而读取由内部服务返回并作为工作流节点输出结果的响应内容。

CVSS 5.0 · Medium EPSS 0.18% · P7
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-100861

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
heym before 0.0.105 SSRF via credential-controlled base URLs
Source: CVE Program / CVE List V5
Vulnerability Description
heym before 0.0.105 fails to apply egress guards to integration services that use credential-supplied base URLs, allowing authenticated users to bypass SSRF protections. Attackers can configure credentials pointing to loopback, private, or cloud-metadata addresses and read internal service responses returned as workflow node output.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
heymrun heym 0 ~ 0.0.105 -

II. Public POCs for CVE-2026-100861

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-100861

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-100861 (1)

Other References for CVE-2026-100861 (1)

Same Patch Batch · heymrun · 2026-09-27 · 10 CVEs total

CVE-2026-100864 8.8 HIGH heym before 0.0.91 Remote Code Execution via Expression Engine
CVE-2026-100865 8.8 HIGH Heym before 0.0.53 Remote Code Execution via eval() Sandbox Escape
CVE-2026-100858 6.8 MEDIUM heym before 0.0.109 Server-Side Request Forgery via Workflow Nodes
CVE-2026-101050 6.5 MEDIUM Heym before 0.0.53 Authentication Bypass via Telegram Webhook
CVE-2026-101049 6.5 MEDIUM Heym before 0.0.53 Slack Webhook Signature Verification Bypass
CVE-2026-100859 6.5 MEDIUM Heym before 0.0.106 Credential Exfiltration via URL Override
CVE-2026-100860 5.5 MEDIUM heym before 0.0.105 Authentication Bypass via Redis Node
CVE-2026-100863 5.0 MEDIUM Heym before 0.0.91 SSRF via image fetching and IPv6 validation
CVE-2026-100862 4.9 MEDIUM heym before 0.0.91 Multiple Secrets Plaintext Storage

IV. Related Vulnerabilities

Same product: heym
Same vendor: heymrun
Same weakness: CWE-918

V. Comments for CVE-2026-100861

No comments yet

Leave a comment