CVE-2026-84207: Heym before 0.0.98 SSRF via WebSocket endpoints
Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes, allowing authenticated users to connect to internal services. Attackers can craft workflow nodes with arbitrary URLs and headers to reach internal services and read responses from the WebSocket Trigger node.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who can craft workflow nodes can exploit the affected WebSocket Send and WebSocket Trigger nodes. No user interaction is required.
What access can an attacker gain through the vulnerable nodes?
An attacker can supply arbitrary URLs and headers to connect to internal services. Responses can be read through the WebSocket Trigger node.
Are installations affected by default?
The available information does not state whether the vulnerable WebSocket nodes are enabled or usable in the default configuration.
What versions should be remediated?
Heym versions before 0.0.98 are affected. Upgrade to 0.0.98 or later.