CVE-2026-67545

Name of the Vulnerable Software and Affected Versions Heym versions prior to 0.0.73

Description The HTTP workflow node makes outbound HTTP requests to user-supplied URLs without validating the target host or IP address. This allows an unauthenticated attacker to trigger a preconfigured Server-Side Request Forgery (SSRF) sink—a vulnerability where the server is coerced into making requests to an unintended location—if a workflow author has configured the node to target internal addresses, such as private network hosts or cloud metadata endpoints, and enabled anonymous execution.

Recommendations Update to version 0.0.73.