CVE-2026-100858: heym SSRF Vulnerability in Workflow Nodes

CVE-2026-100858 Overview

CVE-2026-100858 is a server-side request forgery (SSRF) vulnerability in heym versions before 0.0.109 [CWE-918]. The flaw resides in the Slack, Discord, and Crawler workflow nodes, which issue HTTP requests to URLs sourced from user-created credentials (webhook_url and flaresolverr_url). These nodes use an unguarded HTTP client that bypasses the SSRF egress guard already protecting the HTTP, WebSocket, and MCP nodes. The credential API validates only that the submitted URL is non-empty.

Critical Impact
Any registered user can create a credential pointing at an internal address and execute a workflow, forcing the backend to reach loopback, private, link-local, or cloud-metadata endpoints and return the full response body in the node output.

Affected Products

heym versions prior to 0.0.109
Slack workflow node (unguarded HTTP client)
Discord and Crawler workflow nodes (unguarded HTTP client)

Discovery Timeline

2026-09-27 - CVE-2026-100858 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100858

Vulnerability Analysis

The vulnerability enables non-blind SSRF through workflow execution. An attacker with low-privileged, authenticated access creates a credential object containing a webhook_url or flaresolverr_url pointing at an internal resource. The credential API accepts the URL after confirming only that it is not empty, performing no scheme, hostname, or address-range validation.

When a workflow using the Slack, Discord, or Crawler node runs, the backend dispatches an HTTP request through an HTTP client that lacks the egress protections applied elsewhere in the application. The response body is returned verbatim in the node output, exposing the content of internal services to the attacker.

Because the vulnerable code paths accept arbitrary hostnames, attackers can target loopback interfaces (127.0.0.1), RFC1918 ranges, link-local addresses (169.254.0.0/16), and cloud instance metadata services such as http://169.254.169.254/latest/meta-data/. Retrieval of cloud metadata can expose IAM credentials and lead to broader cloud account compromise.

Root Cause

The root cause is inconsistent enforcement of the SSRF egress guard across workflow node implementations. The HTTP, WebSocket, and MCP nodes route requests through a protected client that filters disallowed destinations. The Slack, Discord, and Crawler nodes were implemented against a separate, unguarded HTTP client. Credential validation at the API layer compounds the issue by accepting any non-empty string as a valid URL.

Attack Vector

Exploitation requires an authenticated account on the heym instance. The attacker registers a credential with a webhook_url or flaresolverr_url pointing at a chosen internal target, binds the credential to a Slack, Discord, or Crawler node, and triggers the workflow. The backend performs the outbound request on the attacker's behalf and places the full response body in the node output visible to the attacker.

For technical details, refer to the GitHub Security Advisory GHSA-39j3-6x3x-8rcr and the VulnCheck Advisory on SSRF in Heym.

Detection Methods for CVE-2026-100858

Indicators of Compromise

Credential objects whose webhook_url or flaresolverr_url fields resolve to loopback, RFC1918, link-local, or 169.254.169.254 addresses.
Workflow executions where Slack, Discord, or Crawler nodes return response bodies containing internal service banners, instance metadata JSON, or IAM role names.
Unexpected outbound HTTP requests from the heym backend host to internal network segments.

Detection Strategies

Audit stored credentials for non-public hostnames or raw IP addresses before upgrading, and quarantine anomalous entries.
Inspect workflow execution logs for Slack, Discord, and Crawler node outputs that include response bodies from internal infrastructure.
Monitor network egress from the application host for connections to 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and 169.254.0.0/16.

Monitoring Recommendations

Alert on authenticated API calls that create credentials with URL schemes or hostnames outside an approved allowlist.
Correlate workflow execution events with host-level network telemetry to detect requests targeting the cloud metadata endpoint.
Record and review changes to credential objects, including user, timestamp, and URL value.

How to Mitigate CVE-2026-100858

Immediate Actions Required

Upgrade heym to version 0.0.109 or later on all deployments.
Review existing Slack, Discord, and Crawler credentials and delete any referencing internal, loopback, or metadata endpoints.
Rotate any cloud IAM credentials, API tokens, or secrets that were reachable from the heym backend host.

Patch Information

The maintainers released a fix in heym version 0.0.109. The patch routes the Slack, Discord, and Crawler nodes through the same SSRF egress guard already used by the HTTP, WebSocket, and MCP nodes, and tightens credential URL validation. Patch details are published in the GitHub Security Advisory GHSA-39j3-6x3x-8rcr.

Workarounds

Restrict account registration and limit workflow creation to trusted users until the upgrade is applied.
Enforce network egress filtering on the heym backend host to block traffic to internal ranges and 169.254.169.254.
Where supported by the cloud provider, require Instance Metadata Service v2 (IMDSv2) with hop-limit 1 to prevent metadata retrieval through SSRF.

bash

# Configuration example
# Upgrade heym to the patched release
pip install --upgrade 'heym>=0.0.109'

# Enforce IMDSv2 on an AWS EC2 instance hosting heym
aws ec2 modify-instance-metadata-options \
  --instance-id i-0123456789abcdef0 \
  --http-tokens required \
  --http-put-response-hop-limit 1 \
  --http-endpoint enabled