CVE-2026-84207

Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes, allowing authenticated users to connect to internal services. Attackers can craft workflow nodes with arbitrary URLs and headers to reach internal services and read responses from the WebSocket Trigger node.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/heymrun/heym
https://github.com/heymrun/heym/blob/v0.0.97/backend/app/services/websocket_trigger_service.py
https://github.com/heymrun/heym/blob/v0.0.97/backend/app/services/websocket_utils.py
https://github.com/heymrun/heym/commit/540aade7c7495295062f32f4dfd0d6805f066f0c
https://github.com/heymrun/heym/releases/tag/v0.0.98
https://github.com/heymrun/heym/security/advisories/GHSA-mqw6-g845-w596
https://www.vulncheck.com/advisories/heym-before-0.0.98-ssrf-via-websocket-endpoints

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-01 16:17

Updated : 2026-09-08 20:18

NVD link : CVE-2026-84207

Mitre link : CVE-2026-84207

CVE.ORG link : CVE-2026-84207

JSON object : View

Products Affected

No product.

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-84207", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-84207", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-01T17:30:12.250553Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/heymrun/heym", "vendor": "heymrun", "product": "heym", "versions": [{"status": "affected", "version": "0", "lessThan": "0.0.98", "versionType": "semver"}, {"status": "unaffected", "version": "0.0.98", "versionType": "semver"}], "packageURL": "pkg:github/heymrun/heym", "collectionURL": "https://github.com/heymrun/heym", "defaultStatus": "unaffected"}]}], "published": "2026-09-01T16:17:35.763", "references": [{"url": "https://github.com/heymrun/heym", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/heymrun/heym/blob/v0.0.97/backend/app/services/websocket_trigger_service.py", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/heymrun/heym/blob/v0.0.97/backend/app/services/websocket_utils.py", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/heymrun/heym/commit/540aade7c7495295062f32f4dfd0d6805f066f0c", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/heymrun/heym/releases/tag/v0.0.98", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/heymrun/heym/security/advisories/GHSA-mqw6-g845-w596", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/heym-before-0.0.98-ssrf-via-websocket-endpoints", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes, allowing authenticated users to connect to internal services. Attackers can craft workflow nodes with arbitrary URLs and headers to reach internal services and read responses from the WebSocket Trigger node."}], "lastModified": "2026-09-08T20:18:59.270", "sourceIdentifier": "disclosure@vulncheck.com"}