CVE-2026-100862: Heym Workflow Platform Secret Disclosure

CVE-2026-100862 Overview

CVE-2026-100862 affects heym, a workflow automation platform, in all versions prior to 0.0.91. The platform stores and returns multiple categories of capability secrets in plaintext. Affected material includes webhook header-authentication values, Model Context Protocol (MCP) API keys, portal session tokens, workflow execution JSON Web Tokens (JWTs), Discord interaction tokens, and global variables. Any user with read access to a workflow, membership in a shared team, or read access to the database, backups, or logs can recover these secrets. Recovered secrets can be replayed to execute workflows or impersonate the secret owner. The weakness is categorized under CWE-312: Cleartext Storage of Sensitive Information.

Critical Impact
Plaintext storage of authentication secrets allows any actor with read access to workflows, databases, backups, or logs to replay credentials and act as the secret owner.

Affected Products

heym workflow automation platform, all versions prior to 0.0.91
Deployments exposing MCP API keys via the ?key= query string parameter
Instances persisting Discord interaction tokens or webhook headers into execution history

Discovery Timeline

2026-09-27 - CVE-2026-100862 published to the National Vulnerability Database (NVD)
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-100862

Vulnerability Analysis

The vulnerability spans multiple secret-handling paths within heym. Webhook header-authentication values are returned in cleartext by GET /api/workflows/{id} and persisted unsanitized into execution history. MCP API keys are stored in a plaintext database column and returned in config/list responses. Those keys are also accepted on the ?key= query string, which causes them to leak into web server logs, upstream proxies, and HTTP Referer headers.

Portal session tokens are stored in cleartext and validated through plaintext equality comparisons with a 168-hour time-to-live. Workflow execution JWTs are stored in full and re-listed by GET .../execution-tokens, exposing their complete signed form. Discord interaction tokens are preserved intact because the full interaction body is written to execution history. Global variables share the same cleartext storage model.

Root Cause

The root cause is systemic cleartext storage and transport of authentication material across the platform. The code lacks hashing, envelope encryption, or sanitization before persistence. Query-string handling for MCP keys additionally violates the principle that bearer secrets must travel in authorization headers, not URL components that are routinely logged.

Attack Vector

An authenticated user with workflow read access, a team or share collaborator, or any actor able to read the database, a backup, or application logs can enumerate stored secrets. Attackers replay recovered JWTs, session tokens, webhook headers, MCP keys, or Discord interaction tokens to trigger workflow executions or impersonate the secret owner over the network. No user interaction is required for replay. Full technical analysis is available in the GitHub Security Advisory GHSA-6x65-w7q7-wg93 and the VulnCheck Advisory on Secrets Storage.

Detection Methods for CVE-2026-100862

Indicators of Compromise

Database rows in MCP configuration, portal session, and execution token tables containing values that are not hashed or encrypted.
Web server, reverse proxy, or Content Delivery Network (CDN) access logs containing the ?key= query parameter against heym endpoints.
GET /api/workflows/{id} responses that include populated webhook header-authentication fields in cleartext.
GET .../execution-tokens responses returning full JWT strings rather than token identifiers.

Detection Strategies

Audit the running version of heym and flag any instance below 0.0.91.
Scan execution history records for stored Discord interaction bodies and webhook headers.
Review authentication logs for workflow executions triggered by tokens that match previously disclosed values.
Correlate MCP key usage from unexpected source Internet Protocol (IP) addresses with earlier log lines where the key appeared on a URL.

Monitoring Recommendations

Alert on reads of workflow configuration endpoints by accounts outside the workflow owner or operator roles.
Monitor database export and backup activity targeting tables holding secrets.
Track issuance of workflow execution JWTs and alert on reuse from unexpected clients.

How to Mitigate CVE-2026-100862

Immediate Actions Required

Upgrade heym to version 0.0.91 or later on every deployment.
Rotate all webhook header-authentication values, MCP API keys, portal session tokens, workflow execution JWTs, and global variables after upgrading.
Invalidate active portal sessions and force reauthentication for all users.
Review and sanitize execution history records that contain stored secrets or full Discord interaction bodies.

Patch Information

The maintainers address the issue in heym version 0.0.91. Users must upgrade and then rotate every secret class listed in the advisory. Patch details are published in the GitHub Security Advisory GHSA-6x65-w7q7-wg93.

Workarounds

Restrict read access to workflows, databases, and backup archives to the minimum set of operators required.
Strip the ?key= parameter at the reverse proxy and require MCP keys to be submitted through authorization headers only.
Purge historical web server, proxy, and CDN logs that may contain MCP keys in query strings.
Shorten the 168-hour portal session time-to-live where configuration permits.

bash

# Configuration example: block ?key= on reverse proxy (nginx)
if ($arg_key) {
    return 400;
}