Is CVE-2026-100860 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100860 being exploited in the wild.

How severe is CVE-2026-100860?

Medium severity, with a CVSS score of 5.5, published 27 September 2026.

Is there a fix for CVE-2026-100860?

A patch was published on 2026-09-03: v0.0.105 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100860 attacked?

It is attacked with local access, in a hosted service.

Am I affected by CVE-2026-100860?

Check whether you run Heym at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100860: heym Redis node credential authorization bypass

CVE-2026-100860 · Severity: medium · CVSS 5.5 · Published 2026-09-27

heym is a workflow automation platform that lets users build and execute workflows with various integrations. When an authenticated workflow author references a Redis credential they don't own or that has been deleted, the system falls back to connecting to the local Redis instance on localhost:6379 with no password, bypassing authorization checks. On deployments with an accessible local Redis, this allows unauthorized read/write access to that Redis instance.

Technologies: Heym. Vendors: Heym.

Quick answers

Is CVE-2026-100860 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100860 being exploited in the wild.
How severe is CVE-2026-100860?: Medium severity, with a CVSS score of 5.5, published 27 September 2026.
Which products and versions are affected?: Heym before 0.0.105.
Is there a fix for CVE-2026-100860?: A patch was published on 2026-09-03: v0.0.105 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100860 attacked?: It is attacked with local access, in a hosted service.
Am I affected by CVE-2026-100860?: Check whether you run Heym at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Redis workflow node fails to check the result of _get_accessible_credential(), which returns None on authorization failure or missing credentials. This None is treated as an empty configuration, causing all connection parameters to default to localhost:6379 with no password. An authenticated attacker supplies a credential ID they don't own to trigger this fallback, gaining unauthorized access to any Redis service listening on the backend's loopback interface.

Affected products

heym heym before 0.0.105

Timeline

2026-09-27: disclosed: CVE-2026-100860 published
2026-09-03: patched: v0.0.105 released with fix
2026-09-03: advisory: GHSA-fmpw-hj3m-xvj6 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.