← Back to the live CVE advisory feed

CVE-2026-100858: Product identification pending

Severity

7.6 (HIGH)

Vendor

HEYM BEFORE

Affected versions

Before 0.0.109

Fixed version

0.0.109

Patch status

Patched

Published

2026-09-27T02:17:25.340

Modified

2026-09-27T02:17:25.340

Why it matters

High-severity vulnerability requiring prioritized review.

Recommended admin actions

• Review and patch based on exposure, asset criticality, and business impact.
• Compare installed versions against the affected version range in the advisory.

Technical summary

heym before 0.0.109 contains a server-side request forgery vulnerability in the Slack, Discord, and Crawler workflow nodes. These nodes issue HTTP requests to URLs taken from user-created credentials (webhook_url / flaresolverr_url) using an unguarded HTTP client, bypassing the SSRF egress guard that already protects the HTTP, WebSocket, and MCP nodes; the credential API validates only that the URL is non-empty. Any registered user can create a credential pointing at an internal address and execute a workflow, causing the backend to reach loopback, private, link-local, or cloud-metadata endpoints and return the full response body in the node output (non-blind SSRF).

View the official NVD record for CVE-2026-100858

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.