CVEvulnerability
CVE-2026-84207
5.3 MEDIUM
Official page ↗
- Status
- Deferred
- Published
- 2026-09-01
- Last modified
- 2026-09-08
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 5.3 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weaknesses
- CWE-918
Description
Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes, allowing authenticated users to connect to internal services. Attackers can craft workflow nodes with arbitrary URLs and headers to reach internal services and read responses from the WebSocket Trigger node.
Related
Weakness · CWE (1)
- CWE-918 Server-Side Request Forgery weakness
References
- https://github.com/heymrun/heym github.com
- https://github.com/heymrun/heym/blob/v0.0.97/backend/app/services/websocket_trigger_service.py github.com
- https://github.com/heymrun/heym/blob/v0.0.97/backend/app/services/websocket_utils.py github.com
- https://github.com/heymrun/heym/commit/540aade7c7495295062f32f4dfd0d6805f066f0c github.com
- https://github.com/heymrun/heym/releases/tag/v0.0.98 github.com
- https://github.com/heymrun/heym/security/advisories/GHSA-mqw6-g845-w596 github.com
- https://www.vulncheck.com/advisories/heym-before-0.0.98-ssrf-via-websocket-endpoints www.vulncheck.com