HEYM · CVE-2026-67541 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
Heym lets any non-creator team member add, remove or change team members, because the check looks only at team membership and there is no role field. An attacker who joins a team can then decrypt every credential shared into it, including provider API keys and OAuth tokens.
first public Jul 4, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running self-hosted Heym before version 0.0.70 that store shared credentials such as provider API keys or OAuth tokens. The exposure depends on an attacker already holding a team membership, so deployments without shared team credentials carry less risk. unknown whether the sources cover default configurations beyond this.
Not affected if no-team-shared-credentials, version-0.0.70-or-later
Who cares ai-agents, heym, self-hosted, team-credentials
0.0.70 is affected.0.0.70 or later, which the sources say patches this issue.Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, team-member management (add / remove / update) is gated only on team membership, not on the team creator/admin role — and TeamMember has no role column. Any non-creator member can seat an attacker account into the team; because credential team-shares are scoped only by TeamMember.user_id, the newly-added attacker can then decrypt every credential shared into that team (provider API keys, OAuth tokens. This issue has been patched in version 0.0.70.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.