Is CVE-2026-67545 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-67545 being exploited in the wild.

How severe is CVE-2026-67545?

High severity, with a CVSS score of 7.4, published 11 November 2026.

How is CVE-2026-67545 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-67545?

Check whether you run Heym at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67545: Heym HTTP node server-side request forgery

CVE-2026-67545 · Severity: high · CVSS 7.4 · Published 2026-11-11

Heym is a platform for building and running automated workflows on self-hosted infrastructure. The HTTP workflow node was making outbound requests to user-supplied URLs without validating the target address, allowing an attacker to reach internal services like cloud metadata endpoints or private network hosts if a workflow was exposed for anonymous execution. This could expose sensitive infrastructure data or enable lateral network movement.

Technologies: Heym. Vendors: Heym.

Quick answers

Is CVE-2026-67545 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-67545 being exploited in the wild.
How severe is CVE-2026-67545?: High severity, with a CVSS score of 7.4, published 11 November 2026.
Which products and versions are affected?: Heym before 0.0.73.
Is there a fix for CVE-2026-67545?: Yes: fixed in 0.0.73. Until then: Set the HEYM_HTTP_ALLOW_PRIVATE_URLS environment variable to true only on trusted self-hosted instances; keep it false on hosted or multi-tenant deployments. Do not expose workflows with HTTP nodes targeting internal addresses for anonymous execution.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-11-11"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-67545 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-67545?: Check whether you run Heym at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.0.73

Set the HEYM_HTTP_ALLOW_PRIVATE_URLS environment variable to true only on trusted self-hosted instances; keep it false on hosted or multi-tenant deployments. Do not expose workflows with HTTP nodes targeting internal addresses for anonymous execution.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-11-11"}]

Technical details

The HTTP workflow node in Heym lacked server-side request forgery (SSRF) protection present in the MCP integration, allowing requests to unvalidated user-supplied URLs. An unauthenticated attacker can trigger this vulnerability if a workflow author has configured an HTTP node targeting internal addresses and exposed the workflow with anonymous execution. The fix adds host and IP validation to reject loopback, private, link-local, multicast, and cloud-metadata addresses, and pins resolved IPs at dial time to defeat DNS rebinding and redirects.

Affected products

Heym Heym before 0.0.73

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.