CVE-2026-84207CWE-918ssrf

CVE-2026-84207

Medium · published September 1, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
27.2
In the wild
Unconfirmed
What it is

Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes, allowing authenticated users to connect to internal services. Attackers can craft workflow nodes with arbitrary URLs and headers to reach internal services and read responses from the WebSocket Trigger node.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00348 · 27.2th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-09-01T20:17Z
References (7)
https://github.com/heymrun/heym · [email protected]https://github.com/heymrun/heym/blob/v0.0.97/backend/app/services/websocket_trigger_service.py · [email protected]https://github.com/heymrun/heym/blob/v0.0.97/backend/app/services/websocket_utils.py · [email protected]https://github.com/heymrun/heym/commit/540aade7c7495295062f32f4dfd0d6805f066f0c · [email protected]https://github.com/heymrun/heym/releases/tag/v0.0.98 · [email protected]https://github.com/heymrun/heym/security/advisories/GHSA-mqw6-g845-w596 · [email protected]https://www.vulncheck.com/advisories/heym-before-0.0.98-ssrf-via-websocket-endpoints · [email protected]
EPSS history
Timeline
  • 03 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 01 SEP 15:19Z
    Heym before 0.0.98 SSRF via WebSocket endpoints
    cvelistv5