# CVE-2026-67546: Heym command injection via MCP stdio transport

Source: https://junglewise.ai/threats/cve-2026-67546-heym-builds-and-runs-agentic-systems-and-business-process  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-67546 · Severity: high · CVSS 8.8 · Published 2026-11-11

Heym runs business-process automations on self-hosted servers. An authenticated user with the lowest role could exploit the MCP stdio endpoint to execute arbitrary commands on the backend host, potentially compromising the entire system, particularly if the backend runs as root in a Docker container with access to the Docker socket.

Technologies: [Heym](https://junglewise.ai/threats/technologies/heym-heym). Vendors: [Heym](https://junglewise.ai/threats/vendors/heym).

## Quick answers

**Is CVE-2026-67546 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67546 being exploited in the wild.

**How severe is CVE-2026-67546?** High severity, with a CVSS score of 8.8, published 11 November 2026.

**Which products and versions are affected?** Heym before 0.0.75.

**Is there a fix for CVE-2026-67546?** Yes: fixed in 0.0.75. Until then: Restrict network access to the /api/mcp/fetch-tools endpoint or disable the MCP stdio transport entirely until upgrading to version 0.0.75. Avoid running the backend container with root privileges or mounting docker.sock. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-67546 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-67546?** Check whether you run Heym at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.0.75

Restrict network access to the /api/mcp/fetch-tools endpoint or disable the MCP stdio transport entirely until upgrading to version 0.0.75. Avoid running the backend container with root privileges or mounting docker.sock.

## Technical details

The POST /api/mcp/fetch-tools endpoint accepted caller-supplied commands and arguments for the MCP stdio transport, spawning them directly on the backend host before MCP handshake validation. Any authenticated user at the lowest privilege level could trigger this, and the process executed with access to os.environ (including secret keys, database credentials, and API keys) and potentially docker.sock. The fix sandboxes stdio servers in hardened containers and restricts mount access, environment forwarding, and privilege escalation paths.

## Affected products

- Heym Heym before 0.0.75

## Timeline

- 2026-11-11: disclosed

## References

- [https://github.com/heymrun/heym/commit/22b8ee60eb92128cf4ff04a9b6c0e1b62bf25a01](https://github.com/heymrun/heym/commit/22b8ee60eb92128cf4ff04a9b6c0e1b62bf25a01)
- [https://github.com/heymrun/heym/commit/6c6213f88dfa8b2a70d23a9a271171241e910904](https://github.com/heymrun/heym/commit/6c6213f88dfa8b2a70d23a9a271171241e910904)

## Related threats

- [Heym HTTP node server-side request forgery](https://junglewise.ai/threats/cve-2026-67545-heym-builds-and-runs-agentic-systems-and-business-process)
- [Heym workflow engine arbitrary code execution via Playwright node](https://junglewise.ai/threats/cve-2026-67544-heym-builds-and-runs-agentic-systems-and-business-process)
- [Heym Python skill execution privilege escalation](https://junglewise.ai/threats/cve-2026-67543-heym-builds-and-runs-agentic-systems-and-business-process)
- [Heym server-side request forgery in MCP transports](https://junglewise.ai/threats/cve-2026-67542-heym-builds-and-runs-agentic-systems-and-business-process)
- [Heym team-member management privilege escalation](https://junglewise.ai/threats/cve-2026-67541-heym-builds-and-runs-agentic-systems-and-business-process)