CVE-2026-67542

Name of the Vulnerable Software and Affected Versions Heym versions prior to 0.0.70

Description An authenticated user with the lowest role can trigger a Server-Side Request Forgery (SSRF) by accessing the 'POST /api/mcp/fetch-tools' endpoint. The system fetches a user-supplied URL via sse and streamable http transports without implementing scheme, private-IP, allowlist, or redirect guards. This allows an attacker to control outbound request headers and receive transport errors in the HTTP 422 response, creating a semi-blind SSRF oracle. SSRF is a flaw where a server is tricked into making requests to an unintended location.

Recommendations Update to version 0.0.70.