CVE-2026-84207: Heym SSRF Vulnerability in WebSocket Nodes

CVE-2026-84207 Overview

CVE-2026-84207 is a Server-Side Request Forgery (SSRF) vulnerability in Heym before version 0.0.98. The flaw exists because SSRF egress guards are not applied to the WebSocket Send and WebSocket Trigger workflow nodes. Authenticated users can craft workflow nodes containing arbitrary URLs and headers to reach internal services. The WebSocket Trigger node returns responses to the attacker, enabling reconnaissance and interaction with services that should be inaccessible from the network. The vulnerability is classified under CWE-918: Server-Side Request Forgery.

Critical Impact
Authenticated attackers can pivot through Heym workflow nodes to connect to loopback, private, link-local, and cloud metadata endpoints, exposing internal HTTP services and sensitive data.

Affected Products

Heym versions prior to 0.0.98
Heym WebSocket Send workflow node
Heym WebSocket Trigger workflow node

Discovery Timeline

2026-09-01 - CVE-2026-84207 published to the National Vulnerability Database (NVD)
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-84207

Vulnerability Analysis

Heym implements an SSRF egress guard controlled by the HEYM_HTTP_ALLOW_PRIVATE_URLS configuration option. When set to false (the default), guarded nodes may only reach public addresses. Loopback, private, link-local, and cloud metadata targets are refused. In versions before 0.0.98, this guard was applied to the HTTP node but not to the WebSocket Send or WebSocket Trigger nodes.

An authenticated user with the ability to create or modify workflows can specify arbitrary ws:// or wss:// URLs. The Heym backend then establishes the WebSocket connection from the server. Because the WebSocket Trigger node relays received messages back into the workflow, attackers can read responses from targeted internal services.

Root Cause

The root cause is missing input validation on user-supplied URLs before initiating outbound WebSocket connections in backend/app/services/websocket_trigger_service.py and backend/app/services/websocket_utils.py. The egress guard logic in config.py originally covered only the HTTP node.

Attack Vector

An authenticated attacker builds a workflow that targets an internal WebSocket-capable service, such as an internal admin console, message broker, or cloud metadata endpoint reachable over HTTP-upgrade. Custom headers can be supplied to satisfy internal authentication requirements. The WebSocket Trigger node returns service responses, enabling data exfiltration.

python

# Patch: backend/app/config.py
opencode_git_author_email: str = Field(
    default="support@heym.run", validation_alias="HEYM_OPENCODE_GIT_AUTHOR_EMAIL"
)
# HTTP and WebSocket node SSRF egress guard. When false (default), guarded
# nodes may only reach public addresses; loopback/private/link-local/metadata
# targets are refused. Trusted self-hosted instances that intentionally call
# internal services can opt out with HEYM_HTTP_ALLOW_PRIVATE_URLS=true.
http_allow_private_urls: bool = Field(
    default=False, validation_alias="HEYM_HTTP_ALLOW_PRIVATE_URLS"
)

Source: GitHub Commit 540aade7. The patch extends the existing egress guard to cover WebSocket nodes, refusing connections to non-public destinations by default.

Detection Methods for CVE-2026-84207

Indicators of Compromise

Outbound WebSocket connections from the Heym backend host to RFC1918 addresses, 127.0.0.0/8, 169.254.169.254, or other link-local ranges.
Workflow definitions containing WebSocket Send or WebSocket Trigger nodes with URLs pointing to internal hostnames or IP literals.
Unexpected authentication headers in workflow node configuration referencing internal service tokens.

Detection Strategies

Review Heym workflow definitions and audit URL fields of all WebSocket Send and WebSocket Trigger nodes for non-public destinations.
Correlate Heym application logs with network flow data to identify WebSocket handshakes destined for internal address space.
Alert on any HTTP Upgrade: websocket requests originating from the Heym service account toward metadata or management endpoints.

Monitoring Recommendations

Enable egress filtering at the host or network layer to block Heym backend connections to private and metadata IP ranges.
Ingest Heym application and proxy logs into a centralized analytics platform and build queries for WebSocket destinations outside your approved allowlist.
Monitor authenticated user activity for creation of new WebSocket-based workflow nodes and flag unusual URL patterns for review.

How to Mitigate CVE-2026-84207

Immediate Actions Required

Upgrade Heym to version 0.0.98 or later, which extends the SSRF egress guard to WebSocket nodes.
Verify that HEYM_HTTP_ALLOW_PRIVATE_URLS remains at its default value of false unless internal access is explicitly required.
Audit existing workflows for WebSocket Send and WebSocket Trigger nodes that reference internal endpoints and remove or restrict them.

Patch Information

The fix is available in Heym release v0.0.98. Technical details of the patch are documented in the GitHub Security Advisory GHSA-mqw6-g845-w596 and the VulnCheck SSRF Advisory for Heym.

Workarounds

Restrict workflow creation and editing privileges to trusted users until the patch can be applied.
Deploy the Heym backend behind an egress proxy that denies traffic to loopback, private, link-local, and cloud metadata ranges.
Segment the Heym deployment on a network with no route to sensitive internal services or instance metadata endpoints.

bash

# Configuration example: enforce the default SSRF egress guard
export HEYM_HTTP_ALLOW_PRIVATE_URLS=false

# Verify Heym version is patched
docker exec heym-backend python -c "import app; print(app.__version__)"
# Expected output: 0.0.98 or later