CVE-2026-67542 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
Heym's MCP tool-fetch endpoint accepts an attacker-supplied URL and fetches it from the server without checking scheme, private addresses or redirects. A low-privilege authenticated user can use this to reach internal services and read error responses about them.
first public Jul 5, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that self-host Heym and let ordinary authenticated users reach its MCP tool-fetch endpoint. The flaw sits in the server-side fetch of MCP transports over sse and streamable_http, so deployments with no authenticated users exposed can skip it.
Not affected if auth-required, managed-hosting
Who cares heym, mcp, self-hosted
0.0.70./api/mcp/fetch-tools route in your deployment and whether it is reachable by ordinary user accounts.0.0.70 or later.Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, POST /api/mcp/fetch-tools is reachable by any authenticated user (lowest role; no admin/workflow association) and fetches an attacker-supplied URL through the sse and streamable_http transports with no scheme / private-IP / allowlist / redirect guard. The transport error is reflected in the HTTP 422 response, giving a semi-blind SSRF oracle, and the attacker also controls the outbound request headers. This issue has been patched in version 0.0.70.
This page as .md ·
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.