CVE-2026-67546: Heym: Command execution via POST /api/mcp/fetch-tools stdio transport: supplied command is spawned before MCP validation
Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.75, the same POST /api/mcp/fetch-tools endpoint (any authenticated user, lowest role) also accepts the stdio transport, which spawns the attacker-supplied command with attacker-supplied args and an environment merged over os.environ. The process executes on the shared backend host before MCP protocol validation fails — so side effects fire regardless of whether the command speaks MCP. This is a distinct weakness class and exploit primitive from the SSRF (Advisory 2) on the same endpoint, and needs a different fix (role gating / opt-in trust boundary rather than egress controls). This issue has been patched in version 0.0.75.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.0.75
Event History
Frequently Asked Questions
Which deployments are exposed?
Self-hosted Heym deployments running versions before 0.0.75 are affected if authenticated users can access POST /api/mcp/fetch-tools. The affected capability is available to the lowest authenticated role.
What does an attacker need to exploit this issue?
An attacker needs valid authentication, including a lowest-role account, and the ability to submit a request to the endpoint using the stdio transport. No user interaction is required, and the supplied command can have side effects even if it does not implement the MCP protocol.
Does failed MCP validation prevent command execution?
No. The supplied command is spawned on the shared backend host before MCP protocol validation occurs, so its side effects can occur even when validation subsequently fails.
What should be done if an immediate upgrade is not possible?
Restrict or disable access to the stdio transport on this endpoint, and gate its use to a narrowly trusted role or explicit opt-in trust boundary. Egress controls alone do not address this command-execution primitive.
How can administrators assess potential exposure?
Review whether the deployment is older than 0.0.75 and whether authenticated users, especially lowest-role users, can invoke POST /api/mcp/fetch-tools with stdio transport. Review endpoint activity for requests supplying commands, arguments, or environment values.