CVE-2026-100860 Overview
CVE-2026-100860 is an authorization bypass in the heym workflow automation platform affecting versions before 0.0.105. The flaw resides in the Redis workflow node at backend/app/services/node_execution/nodes/redis_node.py. The node ignores the result of its credential authorization lookup. When _get_accessible_credential returns None, the node silently falls back to default settings and connects to localhost:6379 without a password.
An authenticated workflow author can supply a credential ID they do not own, or one that was deleted, and still obtain a read/write Redis connection on the backend loopback interface. The weakness is categorized as [CWE-636] Not Failing Securely.
Critical Impact
Authenticated workflow authors can bypass credential authorization and execute arbitrary Redis commands against any Redis instance reachable on the backend's loopback interface.
Affected Products
- heym versions prior to 0.0.105
- Deployments that run a Redis server on the backend host loopback interface
- The redis_node.py workflow execution component
Discovery Timeline
- 2026-09-27 - CVE-2026-100860 published to NVD
- 2026-09-28 - Last updated in NVD database
Technical Details for CVE-2026-100860
Vulnerability Analysis
The Redis workflow node performs a credential authorization lookup through _get_accessible_credential but does not act on a None result. Instead of raising an authorization error, the node treats the lookup failure as an empty configuration object. Execution then falls back to default parameters and opens a Redis connection to localhost:6379 with no password.
The same fallback path triggers when an accessible credential contains an empty config or lacks a redis_host value. The requested Redis operation runs against whatever instance is listening on the backend loopback interface. The resulting impact depends on the deployment. The stock docker-compose.yml ships without a Redis service, so the flaw surfaces as a misleading connection error rather than data exposure in default installations.
Root Cause
The root cause is a failure to fail securely [CWE-636]. The code treats a denied or missing credential identically to a missing configuration field. Authorization becomes advisory rather than enforced, because the control-flow branch for None does not raise or return an error.
Attack Vector
An authenticated workflow author submits a Redis node configured with an arbitrary credential ID. The ID can reference a credential owned by another tenant or a credential that has been deleted. The backend attempts the lookup, receives None, and continues execution with default values. The attacker then issues arbitrary Redis commands against any Redis daemon bound to the backend's loopback address, including read, write, and administrative operations exposed by that instance.
No verified proof-of-concept code is published for this issue. See the GitHub Security Advisory and the VulnCheck Advisory for upstream technical detail.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-100860
Indicators of Compromise
- Redis connections originating from the heym backend process to 127.0.0.1:6379 that do not correlate with provisioned credentials.
- Workflow execution logs that reference credential IDs no longer present in the credential store.
- Unexpected GET, SET, DEL, KEYS, or CONFIG commands in Redis MONITOR output when co-located with the heym backend.
Detection Strategies
- Audit heym application logs for workflow runs where the Redis node completed successfully despite a credential lookup returning None.
- Correlate workflow author identity with the owner of the credential ID referenced by each Redis node execution.
- Enable Redis MONITOR or slowlog capture on backend hosts and alert on commands issued by local processes without a corresponding credential binding.
Monitoring Recommendations
- Forward heym backend logs and local Redis command logs into a central data lake for cross-source correlation of authorization decisions and executed commands.
- Alert on any Redis AUTH-less connection to a loopback instance from the heym service account.
- Track installed heym versions across environments and flag any instance below 0.0.105.
How to Mitigate CVE-2026-100860
Immediate Actions Required
- Upgrade heym to version 0.0.105 or later on every backend host.
- Inventory all deployments to confirm whether a Redis service is reachable on the backend loopback interface.
- Rotate any secrets or data previously stored in a loopback Redis instance that was accessible to the heym backend.
- Revoke and reissue credentials for workflow authors suspected of referencing credential IDs they do not own.
Patch Information
The vendor fix is included in heym0.0.105. The patched Redis node raises an authorization error when _get_accessible_credential returns None and no longer falls back to default connection parameters. Review the GitHub Security Advisory GHSA-fmpw-hj3m-xvj6 for the authoritative patch notes.
Workarounds
- Do not run a Redis server on the loopback interface of the heym backend host until the upgrade is complete.
- Bind any required Redis instance to a non-loopback interface protected by requirepass and network ACLs.
- Restrict workflow authoring privileges to trusted users while the vulnerable version is in production.
- Remove or disable the Redis workflow node in environments that do not require it.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
