CVE-2026-101050: Heym Authentication Bypass Vulnerability

CVE-2026-101050 Overview

CVE-2026-101050 is an authentication bypass vulnerability in Heym versions before 0.0.53. The flaw resides in the Telegram webhook endpoint, which fails to verify the X-Telegram-Bot-Api-Secret-Token header when credential_id is absent or secret_token is empty. Remote unauthenticated attackers can post forged Telegram updates to the webhook URL. These forged updates trigger workflows that execute using the owner's configured credentials. The attacker controls the input processed by downstream actions, enabling abuse of integrated services. The weakness is categorized as [CWE-287] Improper Authentication.

Critical Impact
Unauthenticated remote attackers can trigger workflows under the webhook owner's credentials, executing actions against attacker-controlled input.

Affected Products

Heym versions prior to 0.0.53
Telegram webhook trigger nodes within Heym workflows
Slack webhook trigger nodes within Heym workflows (related finding H1 in GHSA-pm6h-x3h5-j38h)

Discovery Timeline

2026-09-27 - CVE-2026-101050 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-101050

Vulnerability Analysis

The vulnerability affects the Telegram webhook handler in backend/app/api/telegram.py. Telegram's webhook security model relies on the sender setting a shared X-Telegram-Bot-Api-Secret-Token header that the receiver must validate against a stored secret. Heym performed this validation only when both a credential_id was present on the trigger node and the retrieved secret_token was non-empty. When either condition failed, the handler skipped verification entirely and processed the request as legitimate. A matching flaw exists in the Slack webhook handler (backend/app/api/slack.py), tracked as finding H1 in advisory GHSA-pm6h-x3h5-j38h.

Root Cause

The authentication logic failed open rather than failing closed. The handler treated missing or incomplete configuration as implicit authorization. Any workflow created without a webhook credential, or with an empty secret, became publicly invokable to anyone who knew or guessed the webhook URL.

Attack Vector

An attacker sends a crafted HTTP POST request mimicking a Telegram Update object to the exposed webhook endpoint. Without the secret-token check, the handler forwards the payload into the workflow engine. The engine executes subsequent nodes using the owner's stored credentials for Telegram, downstream APIs, or data stores. The attacker thereby influences actions performed under another user's identity.

python

     if trigger_node:
         credential_id = trigger_node.get("data", {}).get("credentialId") or None
 
-    if credential_id:
-        async with async_session_maker() as db:
-            telegram_config = await _get_telegram_config(db, credential_id)
-
-        if telegram_config:
-            secret_token = str(telegram_config.get("secret_token") or "").strip()
-            if secret_token:
-                incoming_secret = request.headers.get("x-telegram-bot-api-secret-token", "")
-                if not incoming_secret or not hmac.compare_digest(secret_token, incoming_secret):
-                    raise HTTPException(
-                        status_code=status.HTTP_403_FORBIDDEN,
-                        detail="Invalid Telegram secret token",
-                    )
+    # SECURITY: Telegram webhook secret-token verification must fail closed.
+    # See security advisory GHSA-pm6h-x3h5-j38h, finding H2. Previously, a missing
+    # credential_id, missing config, or empty secret_token caused verification to
+    # be skipped entirely, allowing anyone with the webhook URL to trigger the
+    # workflow with the owner's credentials.
+    if not credential_id:
+        logger.warning(
+            "Telegram webhook rejected: no credential_id on trigger node_id=%s",
+            node_id,
+        )

Source: GitHub Commit 341d101

Detection Methods for CVE-2026-101050

Indicators of Compromise

Incoming POST requests to Telegram or Slack webhook endpoints that lack the X-Telegram-Bot-Api-Secret-Token header or carry a mismatched value.
Unexpected workflow executions whose source IP addresses do not resolve to Telegram infrastructure ranges.
Workflow activity attributed to trigger nodes that have no configured credentialId.

Detection Strategies

Inspect HTTP access logs on Heym instances for Telegram webhook paths accessed by non-Telegram source addresses.
Correlate webhook invocation timestamps with workflow execution logs to identify triggers that bypassed secret-token validation.
Flag any trigger-node configuration audit entries where credentialId is null or secret_token is empty.

Monitoring Recommendations

Enable verbose request logging on the /telegram and /slack webhook routes and alert on 2xx responses from unknown source IPs.
Monitor outbound actions performed by workflows for anomalous recipients or arguments supplied via webhook payloads.
Track Heym version strings across deployments and alert when any instance reports a version below 0.0.53.

How to Mitigate CVE-2026-101050

Immediate Actions Required

Upgrade all Heym deployments to version 0.0.53 or later as published in commit 341d101.
Audit every Telegram and Slack trigger node and confirm each has a valid credentialId and a non-empty secret_token.
Rotate any Telegram bot tokens and downstream credentials that may have been exercised through unauthenticated webhook invocations.

Patch Information

The fix in commit 341d1012367cd74f85c617e1c98dd49e3fcb5e83 changes both the Telegram and Slack webhook handlers to fail closed. Requests are rejected with a generic 403 response when credential_id is missing, configuration is unavailable, or the shared secret is empty. See the GitHub Security Advisory GHSA-pm6h-x3h5-j38h and the VulnCheck Authentication Bypass Advisory for complete details.

Workarounds

Place Heym webhook endpoints behind a reverse proxy that enforces source-IP allowlisting restricted to Telegram and Slack infrastructure.
Disable or delete any Telegram or Slack trigger nodes that cannot be configured with a credential and shared secret until the patch is applied.
Require authenticated reverse-proxy headers on the webhook routes as a defense-in-depth control pending upgrade.

bash

# Upgrade Heym to the patched release
pip install --upgrade "heym>=0.0.53"

# Verify installed version
python -c "import heym; print(heym.__version__)"