# CVE-2026-67542: Heym server-side request forgery in MCP transports

Source: https://junglewise.ai/threats/cve-2026-67542-heym-builds-and-runs-agentic-systems-and-business-process  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-67542 · Severity: high · CVSS 7.1 · Published 2026-11-11

Heym is a platform for running AI agent systems and business automation workflows on self-hosted infrastructure. Any authenticated user could make the server fetch attacker-controlled URLs through internal MCP transports, potentially exposing cloud metadata, loopback services, and internal network resources. An attacker could probe internal networks, access AWS/cloud credentials, or reach internal services not meant to be exposed.

Technologies: [Heym](https://junglewise.ai/threats/technologies/heym-heym). Vendors: [Heym](https://junglewise.ai/threats/vendors/heym).

## Quick answers

**Is CVE-2026-67542 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67542 being exploited in the wild.

**How severe is CVE-2026-67542?** High severity, with a CVSS score of 7.1, published 11 November 2026.

**Which products and versions are affected?** Heym before 0.0.70.

**Is there a fix for CVE-2026-67542?** Yes: fixed in 0.0.70. Until then: Self-hosted operators who intentionally run internal MCP servers can opt out of the egress guard by setting the environment variable HEYM_MCP_ALLOW_PRIVATE_URLS=true. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-67542 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-67542?** Check whether you run Heym at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.0.70

Self-hosted operators who intentionally run internal MCP servers can opt out of the egress guard by setting the environment variable HEYM_MCP_ALLOW_PRIVATE_URLS=true.

## Technical details

The POST /api/mcp/fetch-tools endpoint and related MCP transport handlers did not validate the destination URL before fetching, allowing any authenticated user to supply arbitrary URLs and request headers for the sse and streamable_http transports. The vulnerability enabled SSRF attacks with no guards against private IPs, loopback, metadata services, or redirects, and transported errors were partially reflected in HTTP 422 responses. The fix adds egress validation to reject private/loopback/multicast addresses, disables redirects on MCP clients, and pins resolved IPs at dial time to prevent DNS rebinding attacks.

## Affected products

- Heym Heym before 0.0.70

## Timeline

- 2026-11-11: disclosed

## References

- [https://github.com/heymrun/heym/commit/72954f1f6264f6260bc1148b09ca10d613992b64](https://github.com/heymrun/heym/commit/72954f1f6264f6260bc1148b09ca10d613992b64)
- [https://github.com/heymrun/heym/releases/tag/0.0.70](https://github.com/heymrun/heym/releases/tag/0.0.70)

## Related threats

- [Heym command injection via MCP stdio transport](https://junglewise.ai/threats/cve-2026-67546-heym-builds-and-runs-agentic-systems-and-business-process)
- [Heym HTTP node server-side request forgery](https://junglewise.ai/threats/cve-2026-67545-heym-builds-and-runs-agentic-systems-and-business-process)
- [Heym workflow engine arbitrary code execution via Playwright node](https://junglewise.ai/threats/cve-2026-67544-heym-builds-and-runs-agentic-systems-and-business-process)
- [Heym Python skill execution privilege escalation](https://junglewise.ai/threats/cve-2026-67543-heym-builds-and-runs-agentic-systems-and-business-process)
- [Heym team-member management privilege escalation](https://junglewise.ai/threats/cve-2026-67541-heym-builds-and-runs-agentic-systems-and-business-process)