GHSA-jjvx-3wfc-p8hq: Heym: SSRF via POST /api/mcp/fetch-tools: any authenticated user reaches local/private URLs through the SSE and streamable-HTTP transports
Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, POST /api/mcp/fetch-tools is reachable by any authenticated user (lowest role; no admin/workflow association) and fetches an attacker-supplied URL through the sse and streamablehttp transports with no scheme / private-IP / allowlist / redirect guard. The transport error is reflected in the HTTP 422 response, giving a semi-blind SSRF oracle, and the attacker also controls the outbound request headers. This issue has been patched in version 0.0.70.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.0.70
Event History
Frequently Asked Questions
Which deployments are exposed?
Self-hosted Heym deployments running a version earlier than 0.0.70 are affected. The vulnerable endpoint is available to any authenticated user, including the lowest-privileged role, without an administrator role or workflow association.
What does an attacker need to exploit this issue?
An attacker needs valid authentication and the ability to send a POST request to /api/mcp/fetch-tools. They can supply a target URL and control outbound request headers used through the SSE and streamable-HTTP transports.
What internal targets can be reached?
The endpoint has no scheme restriction, private-IP protection, allowlist, or redirect guard. An authenticated attacker can therefore direct requests toward local or private URLs, including targets reached through redirects.
How could an organization identify attempted exploitation?
Review requests to POST /api/mcp/fetch-tools from authenticated users, especially requests containing unexpected internal, local, or private target URLs. HTTP 422 responses may expose transport errors and can indicate use of the endpoint as a semi-blind SSRF oracle.
What remediation is available?
Upgrade Heym to version 0.0.70, which patches the issue.