Executive brief
heym is a workflow automation platform that integrates with external services like Jira, Grist, and Supabase. Authenticated users can bypass network security controls by configuring integration credentials to point to internal or private addresses, allowing them to read sensitive responses that should not be accessible, such as cloud metadata or internal API data.
Technical details
The vulnerability is a server-side request forgery (SSRF) in integration services that accept credential-supplied base URLs. Services including Jira, Grist, Supabase, Sentry, GitHub, and LLM providers construct HTTP clients directly from user-controlled credentials without applying the egress guard that normally blocks requests to private, loopback, or cloud-metadata addresses. An authenticated attacker can create credentials pointing to internal addresses and trigger workflow execution to read the response as node output.
Affected products
- heymrun heym before 0.0.105
Timeline
- 2026-09-27: disclosed
- 2026-09-27: patched: Fixed in version 0.0.105