Is CVE-2026-100858 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100858 being exploited in the wild.

How severe is CVE-2026-100858?

Medium severity, with a CVSS score of 6.8, published 27 September 2026.

Is there a fix for CVE-2026-100858?

A patch was published on 2026-09-27: version 0.0.109 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100858 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-100858?

Check whether you run Heymrun Heym at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100858: heym server-side request forgery in workflow nodes

CVE-2026-100858 · Severity: medium · CVSS 6.8 · Published 2026-09-27

heym is a workflow automation platform that allows users to create workflows with Slack, Discord, and web crawler nodes. A server-side request forgery vulnerability allows any registered user to make the backend reach internal network addresses and cloud metadata endpoints by crafting malicious credentials, potentially exposing sensitive configuration, API responses, and cloud metadata that could lead to further compromise.

Technologies: Heymrun Heym. Vendors: Heymrun.

Quick answers

Is CVE-2026-100858 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100858 being exploited in the wild.
How severe is CVE-2026-100858?: Medium severity, with a CVSS score of 6.8, published 27 September 2026.
Which products and versions are affected?: Heymrun Heym before 0.0.109.
Is there a fix for CVE-2026-100858?: A patch was published on 2026-09-27: version 0.0.109 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100858 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-100858?: Check whether you run Heymrun Heym at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Slack, Discord, and Crawler workflow nodes accept URLs from user-created credentials (webhook_url and flaresolverr_url) and issue HTTP requests via an unguarded HTTP client, bypassing the SSRF guard that protects other nodes. The vulnerability is non-blind SSRF: the full response body is returned in node output. Exploitation requires user registration and workflow execution permissions, with no additional complexity beyond crafting a credential pointing to loopback (127.0.0.1), private subnets, link-local addresses, or cloud metadata endpoints.

Affected products

heymrun heym before 0.0.109

Timeline

2026-09-12: disclosed
2026-09-27: patched: version 0.0.109

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.