Vulnerability · Published Sep 1, 2026 · Assigned by VulnCheck
CVE-2026-84207Heym before 0.0.98 SSRF via WebSocket endpoints
Medium 5.4
In plain English
A medium-severity server-side request forgery in heym from heymrun. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities).
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.3%top 71.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes, allowing authenticated users to connect to internal services. Attackers can craft workflow nodes with arbitrary URLs and headers to reach internal services and read responses from the WebSocket Trigger node.
Affected products (as reported)
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
References
- https://github.com/heymrun/heym product
- GitHub Security Advisory (GHSA-mqw6-g845-w596) vendor-advisory
- Patch Commit patch
- Heym v0.0.98 Release Notes release-notes
- https://github.com/heymrun/heym/blob/v0.0.97/backend/app/services/websocket_utils.py technical-description
- https://github.com/heymrun/heym/blob/v0.0.97/backend/app/services/websocket_trigger_service.py technical-description
- VulnCheck Advisory: Heym before 0.0.98 SSRF via WebSocket endpoints third-party-advisory