# CVE-2026-100862: heym workflow automation multiple secrets plaintext storage

Source: https://junglewise.ai/threats/cve-2026-100862-heym-a-workflow-automation-platform-stores-and-returns-multiple  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-27. Updated: 2026-09-27  
License: CC BY 4.0 with a link back

CVE-2026-100862 · Severity: medium · CVSS 4.9 · Published 2026-09-27

heym is a workflow automation platform that allows users to orchestrate tasks and integrations. The platform stores multiple types of capability secrets—including webhook authentication headers, API keys, session tokens, and integration tokens—in plaintext rather than encrypted, allowing anyone with database access, backups, logs, or low-privilege workspace membership to recover and replay these secrets to execute workflows or impersonate legitimate users.

Technologies: [Heym](https://junglewise.ai/threats/technologies/heym-heym). Vendors: [Heym](https://junglewise.ai/threats/vendors/heym).

## Quick answers

**Is CVE-2026-100862 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100862 being exploited in the wild.

**How severe is CVE-2026-100862?** Medium severity, with a CVSS score of 4.9, published 27 September 2026.

**Which products and versions are affected?** Heym prior to 0.0.91.

**Is there a fix for CVE-2026-100862?** A patch was published on 2026-09-27: Fix released in version 0.0.91 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-100862 attacked?** It is attacked over the network or with local access, in a software library.

**Am I affected by CVE-2026-100862?** Check whether you run Heym at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Six distinct secret-handling gaps allow plaintext recovery: webhook auth headers are returned in API responses and persisted unsanitized to execution history; MCP API keys are stored and returned in plaintext, accepted via query strings (leaking to logs and proxies); portal session tokens are stored and validated by plaintext equality; workflow execution JWTs are stored in full and re-listed; Discord interaction tokens are persisted in execution history; and global variables are stored unencrypted and fully readable by team members. An attacker with database read access, backup access, log access, or workflow/team membership can extract these secrets and use them to execute workflows as the legitimate owner.

## Affected products

- heym heym prior to 0.0.91

## Timeline

- 2026-08-15: disclosed: GitHub security advisory GHSA-6x65-w7q7-wg93 published
- 2026-09-27: patched: Fix released in version 0.0.91
- 2026-09-27: advisory: NVD entry published as CVE-2026-100862

## References

- [https://github.com/heymrun/heym/security/advisories/GHSA-6x65-w7q7-wg93](https://github.com/heymrun/heym/security/advisories/GHSA-6x65-w7q7-wg93)
- [https://www.vulncheck.com/advisories/heym-before-0.0.91-multiple-secrets-plaintext-storage](https://www.vulncheck.com/advisories/heym-before-0.0.91-multiple-secrets-plaintext-storage)

## Related threats

- [Heym command injection via MCP stdio transport](https://junglewise.ai/threats/cve-2026-67546-heym-builds-and-runs-agentic-systems-and-business-process)
- [Heym HTTP node server-side request forgery](https://junglewise.ai/threats/cve-2026-67545-heym-builds-and-runs-agentic-systems-and-business-process)
- [Heym workflow engine arbitrary code execution via Playwright node](https://junglewise.ai/threats/cve-2026-67544-heym-builds-and-runs-agentic-systems-and-business-process)
- [Heym Python skill execution privilege escalation](https://junglewise.ai/threats/cve-2026-67543-heym-builds-and-runs-agentic-systems-and-business-process)
- [Heym server-side request forgery in MCP transports](https://junglewise.ai/threats/cve-2026-67542-heym-builds-and-runs-agentic-systems-and-business-process)