CVE-2026-67542: Heym: SSRF via POST /api/mcp/fetch-tools: any authenticated user reaches local/private URLs through the SSE and streamable-HTTP transports
Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, POST /api/mcp/fetch-tools is reachable by any authenticated user (lowest role; no admin/workflow association) and fetches an attacker-supplied URL through the sse and streamablehttp transports with no scheme / private-IP / allowlist / redirect guard. The transport error is reflected in the HTTP 422 response, giving a semi-blind SSRF oracle, and the attacker also controls the outbound request headers. This issue has been patched in version 0.0.70.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Heymto a version that resolves this vulnerability.Fixed in 0.0.70
Event History
Frequently Asked Questions
Which deployments are affected?
Heym versions prior to 0.0.70 are affected. The vulnerable endpoint is reachable by any authenticated user, including the lowest role, without an administrator role or workflow association.
What does an attacker need to exploit this issue?
An attacker needs valid Heym authentication and the ability to submit a POST request to /api/mcp/fetch-tools. They can supply the target URL and control outbound request headers when using the SSE or streamable-HTTP transports.
Can this be used to reach internal services?
Yes. Before 0.0.70, the endpoint did not enforce scheme restrictions, private-IP protections, allowlists, or redirect guards, allowing requests to attacker-selected local or private URLs.
How could exploitation be detected or confirmed?
Review requests to POST /api/mcp/fetch-tools for attacker-controlled URLs, particularly local or private-network destinations and use of SSE or streamable-HTTP transports. HTTP 422 responses containing reflected transport errors may indicate attempted SSRF probing.
What should be done if upgrading is not immediately possible?
The provided data identifies version 0.0.70 as the patch. Until it can be applied, restrict access to the affected endpoint so that low-privileged authenticated users cannot invoke it.