Is CVE-2026-110873 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-110873 being exploited in the wild.

How severe is CVE-2026-110873?

High severity, with a CVSS score of 7.1, published 14 October 2026.

Which products and versions are affected?

Heymrun Heym 0.0.55 to 0.0.120.

Is there a fix for CVE-2026-110873?

Yes: fixed in 0.0.121. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-110873 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-110873?

Check whether you run Heymrun Heym at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-110873: Heym privilege escalation via error_workflow_id field

CVE-2026-110873 · Severity: high · CVSS 7.1 · Published 2026-10-14

Heym is a workflow automation platform that allows teams to collaborate on data processing pipelines. A vulnerability in versions 0.0.55 through 0.0.120 allows shared collaborators to redirect error handling workflows to attacker-controlled workflows, enabling them to steal the workflow owner's encrypted credentials. This could lead to unauthorized access to all accounts and data the owner can access.

Technologies: Heymrun Heym. Vendors: Heymrun.

Quick answers

Is CVE-2026-110873 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-110873 being exploited in the wild.
How severe is CVE-2026-110873?: High severity, with a CVSS score of 7.1, published 14 October 2026.
Which products and versions are affected?: Heymrun Heym 0.0.55 to 0.0.120.
Is there a fix for CVE-2026-110873?: Yes: fixed in 0.0.121. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-110873 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-110873?: Check whether you run Heymrun Heym at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.0.121

Technical details

The error_workflow_id field was not included in the OWNER_ONLY_EXECUTION_FIELDS list, allowing collaborators to overwrite it via PUT /api/workflows/{id}. When the parent workflow encounters an error, the system executes the specified error workflow with the owner's decrypted credentials injected into the context, which an attacker can exfiltrate using an HTTP node. The fix adds error_workflow_id to the protected fields list.

Affected products

heymrun Heym 0.0.55 to 0.0.120

Timeline

2026-09-30: disclosed
2026-10-14: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.