CVE-2026-100863 Overview
CVE-2026-100863 affects Heym versions 0.0.90 and earlier. The flaw consists of two server-side request forgery (SSRF) [CWE-918] egress gaps in the application's image-fetching and IPv6 address validation logic. A caller controlling a workflow input can direct the server to fetch internal destinations, including loopback interfaces, RFC1918 ranges, link-local addresses, and cloud instance metadata endpoints. The maintainers remediated both issues in version 0.0.91 by routing the image loader through the guarded HTTP client and expanding IPv6 transition address evaluation inside app/services/ssrf_guard.py.
Critical Impact
Authenticated or webhook-reachable callers can coerce Heym into issuing HTTP requests to internal network addresses and cloud metadata services, enabling disclosure of information reachable from the server.
Affected Products
- Heym versions 0.0.90 and earlier
- Heym LLM image-edit workflow component (_load_image_bytes)
- Heym SSRF guard component (_is_public_address in app/services/ssrf_guard.py)
Discovery Timeline
- 2026-09-27 - CVE-2026-100863 published to NVD
- 2026-09-30 - Last updated in NVD database
Technical Details for CVE-2026-100863
Vulnerability Analysis
Heym's workflow engine permits authors to bind the imageInput field to caller-controlled values through the expression "imageInput": "$userInput.body.imageUrl". When evaluated, the LLM image-edit loader _load_image_bytes fetched the target URL using a bare httpx.get call. The loader performed only a URL scheme check and bypassed Heym's egress-pinning HTTP client entirely. A caller that reaches a workflow using this expression therefore controls the HTTP destination.
The second gap sits inside the SSRF guard. The _is_public_address function unwrapped only IPv4-mapped IPv6 addresses before classification. IPv6 transition forms carrying private IPv4 destinations slipped past both the initial URL validation and the dial-time IP pin, including the NAT64 well-known prefix 64:ff9b::/96, deprecated IPv4-compatible ::x.x.x.x addresses, and 6to4 2002::/16. Python 3.11.0 through 3.11.9 classifies 6to4 as globally routable, compounding the gap.
Root Cause
The root cause is incomplete egress enforcement. The image loader did not consistently use the guarded HTTP client, and the IPv6 classifier did not decode transition-format addresses into their embedded IPv4 destinations before applying the private-range checks.
Attack Vector
An attacker supplies an imageUrl value through a webhook or API call that reaches a workflow using the $userInput.body.imageUrl binding. The URL can resolve to IPv4 loopback or RFC1918 ranges, or to an IPv6 transition address such as [64:ff9b::a9fe:a9fe] that embeds the AWS metadata address 169.254.169.254. The server fetches the target and returns or processes the response within the workflow.
No verified exploit code is published. See the GitHub Security Advisory GHSA-6rph-qqcv-jqh4 and the Vulncheck SSRF Advisory for Heym for the maintainer's technical description.
Detection Methods for CVE-2026-100863
Indicators of Compromise
- Outbound HTTP requests from Heym application hosts to 169.254.169.254, fd00::/8, or RFC1918 ranges that originate from image-fetch workflows.
- Workflow executions where imageInput resolves to IPv6 addresses in 64:ff9b::/96, 2002::/16, or ::x.x.x.x form.
- Unexpected cloud metadata responses captured in Heym application logs or LLM input traces.
Detection Strategies
- Inspect Heym workflow definitions for $userInput.body.imageUrl bindings and audit which webhooks or API routes can invoke them.
- Monitor egress from Heym hosts for destinations outside the expected content delivery and model provider ranges.
- Correlate webhook request payloads containing IPv6 literals with subsequent internal network connections from the same process.
Monitoring Recommendations
- Enable VPC flow logs or host-level egress logging on Heym application instances and alert on connections to link-local and metadata ranges.
- Log full URLs passed to the image loader and retain them for post-incident review.
- Alert on any HTTP client invocation from Heym that does not pass through guard_http_url after upgrade.
How to Mitigate CVE-2026-100863
Immediate Actions Required
- Upgrade Heym to version 0.0.91 or later, which routes the image loader through guard_http_url and the guarded HTTP client.
- Audit all workflow definitions for the $userInput.body.imageUrl expression and restrict callers that can invoke them.
- Enforce cloud metadata service hardening, such as IMDSv2 on AWS, to blunt metadata exfiltration if SSRF succeeds.
Patch Information
Heym 0.0.91 remediates both gaps inside app/services/ssrf_guard.py. The patch evaluates NAT64 and IPv4-compatible addresses by their embedded IPv4 address and refuses 64:ff9b:1::/48, 6to4 2002::/16, and Teredo 2001::/32 outright. Refer to the GitHub Security Advisory GHSA-6rph-qqcv-jqh4 for commit-level details.
Workarounds
- Block outbound traffic from Heym hosts to RFC1918, loopback, link-local, and 169.254.169.254 at the network layer.
- Disable workflow templates that bind imageInput to user-controlled fields until the upgrade is complete.
- Terminate IPv6 egress from Heym application subnets if IPv6 is not required for legitimate image sources.
# Example egress restriction (Linux nftables)
nft add rule inet filter output ip daddr { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16 } drop
nft add rule inet filter output ip6 daddr { ::1/128, fc00::/7, fe80::/10, 64:ff9b::/96, 2002::/16, 2001::/32 } drop
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
