CVE-2026-84207

Name of the Vulnerable Software and Affected Versions Heym versions prior to 0.0.98

Description Authenticated users can connect to internal services because the software fails to apply Server-Side Request Forgery (SSRF) egress guards to the WebSocket Send and WebSocket Trigger nodes. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. Attackers can create workflow nodes with arbitrary URLs and headers to access internal services and read responses from the WebSocket Trigger node.

Recommendations Update to version 0.0.98 or later.