{"id":"CVE-2026-67542","kind":"vulnerability","aliases":["CVE-2026-67542"],"related":[],"title":"Heym: any logged-in user can make the server fetch arbitrary URLs","description":"Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, POST /api/mcp/fetch-tools is reachable by any authenticated user (lowest role; no admin/workflow association) and fetches an attacker-supplied URL through the sse and streamable_http transports with no scheme / private-IP / allowlist / redirect guard. The transport error is reflected in the HTTP 422 response, giving a semi-blind SSRF oracle, and the attacker also controls the outbound request headers. This issue has been patched in version 0.0.70.","summary":"Heym's MCP tool-fetch endpoint accepts an attacker-supplied URL and fetches it from the server without checking scheme, private addresses or redirects. A low-privilege authenticated user can use this to reach internal services and read error responses about them.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","heym","mcp","self-hosted"],"not_affected_if":["auth-required","managed-hosting"],"how_to_check":"- Check the installed Heym version and confirm it is below `0.0.70`.\n- Look for the `/api/mcp/fetch-tools` route in your deployment and whether it is reachable by ordinary user accounts.","fix":"- Heym: upgrade to `0.0.70` or later.","status":"open","published_at":"2026-11-11T22:17:28+00:00","first_seen_at":"2026-11-11T22:29:35+00:00","triaged_at":"2026-11-11T22:33:55+00:00","updated_at":"2026-11-11T22:33:55+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-11T22:33:55Z","model":"claude-haiku-5-5","output":{"fix":"- Heym: upgrade to `0.0.70` or later.","reach":"network","title":"Heym: any logged-in user can make the server fetch arbitrary URLs","impact":"medium","summary":"Heym's MCP tool-fetch endpoint accepts an attacker-supplied URL and fetches it from the server without checking scheme, private addresses or redirects. A low-privilege authenticated user can use this to reach internal services and read error responses about them.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["heym","self-hosted","mcp"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"server fetches internal URLs and leaks reachable internal service details","analyst_note":"","how_to_check":"- Check the installed Heym version and confirm it is below `0.0.70`.\n- Look for the `/api/mcp/fetch-tools` route in your deployment and whether it is reachable by ordinary user accounts.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["managed-hosting","auth-required"],"who_is_affected":"Teams that self-host Heym and let ordinary authenticated users reach its MCP tool-fetch endpoint. The flaw sits in the server-side fetch of MCP transports over sse and streamable_http, so deployments with no authenticated users exposed can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000734,"input_tokens":4686,"output_tokens":531,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-67542':16A,19A '/api/mcp/fetch-tools':92C '0.0.70':90C,160C '422':135C 'accept':35B 'address':51B 'admin/workflow':102C 'agent':75C 'ai':21B 'ai-tool':20B 'allowlist':124C 'also':147C 'arbitrari':12A 'associ':103C 'attack':38B,108C,146C 'attacker-suppli':37B,107C 'authent':58B,97C 'autom':81C 'blind':141C 'build':72C 'busi':79C 'business-process':78C 'check':48B 'control':148C 'cve':14A,17A 'endpoint':34B 'error':69B,129C 'fetch':11A,33B,42B,105C 'give':137C 'guard':126C 'header':152C 'heym':1A,23B,28B,71C 'host':27B,85C 'http':116C,134C 'infrastructur':86C 'intern':65B 'ip':123C 'issu':154C 'log':4A 'logged-in':3A 'low':56B 'low-privileg':55B 'lowest':99C 'make':8A 'mcp':24B,30B 'oracl':143C 'outbound':150C 'patch':157C 'post':91C 'prior':87C 'privat':50B,122C 'private-ip':121C 'privileg':57B 'process':80C 'reach':64B 'reachabl':94C 'read':68B 'redirect':53B,125C 'reflect':131C 'request':151C 'respons':70B,136C 'role':100C 'run':74C 'scheme':49B,120C 'self':26B,84C 'self-host':25B,83C 'semi':140C 'semi-blind':139C 'server':10A,46B 'servic':66B 'sse':113C 'ssrf':142C 'streamabl':115C 'suppli':39B,109C 'system':76C 'tool':22B,32B 'tool-fetch':31B 'transport':117C,128C 'url':13A,40B,110C 'use':61B 'user':6A,59B,98C 'version':89C,159C 'without':47B","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Heym and let ordinary authenticated users reach its MCP tool-fetch endpoint. The flaw sits in the server-side fetch of MCP transports over sse and streamable_http, so deployments with no authenticated users exposed can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","heym","high","mcp","selfhosted"],"campaign_type":null,"search_a":"'-2026':15A,18A '-67542':16A,19A 'arbitrari':12A 'cve':14A,17A 'fetch':11A 'heym':1A 'log':4A 'logged-in':3A 'make':8A 'server':10A 'url':13A 'user':6A","search_b":"'accept':35B 'address':51B 'ai':21B 'ai-tool':20B 'attack':38B 'attacker-suppli':37B 'authent':58B 'check':48B 'endpoint':34B 'error':69B 'fetch':33B,42B 'heym':23B,28B 'host':27B 'intern':65B 'low':56B 'low-privileg':55B 'mcp':24B,30B 'privat':50B 'privileg':57B 'reach':64B 'read':68B 'redirect':53B 'respons':70B 'scheme':49B 'self':26B 'self-host':25B 'server':46B 'servic':66B 'suppli':39B 'tool':22B,32B 'tool-fetch':31B 'url':40B 'use':61B 'user':59B 'without':47B","search_c":"'/api/mcp/fetch-tools':92C '0.0.70':90C,160C '422':135C 'admin/workflow':102C 'agent':75C 'allowlist':124C 'also':147C 'associ':103C 'attack':108C,146C 'attacker-suppli':107C 'authent':97C 'autom':81C 'blind':141C 'build':72C 'busi':79C 'business-process':78C 'control':148C 'error':129C 'fetch':105C 'give':137C 'guard':126C 'header':152C 'heym':71C 'host':85C 'http':116C,134C 'infrastructur':86C 'ip':123C 'issu':154C 'lowest':99C 'oracl':143C 'outbound':150C 'patch':157C 'post':91C 'prior':87C 'privat':122C 'private-ip':121C 'process':80C 'reachabl':94C 'redirect':125C 'reflect':131C 'request':151C 'respons':136C 'role':100C 'run':74C 'scheme':120C 'self':84C 'self-host':83C 'semi':140C 'semi-blind':139C 'sse':113C 'ssrf':142C 'streamabl':115C 'suppli':109C 'system':76C 'transport':117C,128C 'url':110C 'user':98C 'version':89C,159C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-05T07:45:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-67542","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67542","severity":null,"published_at":"2026-11-11T22:17:28+00:00","modified_at":"2026-11-11T22:17:28+00:00","first_seen_at":"2026-11-11T22:29:35+00:00","fetched_at":"2026-11-11T22:29:35+00:00","note":null}],"documents":[{"id":129439,"url":"https://github.com/heymrun/heym/commit/72954f1f6264f6260bc1148b09ca10d613992b64","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":129432,"url":"https://github.com/heymrun/heym/releases/tag/0.0.70","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":129441,"url":"https://github.com/heymrun/heym/security/advisories/GHSA-jjvx-3wfc-p8hq","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-05T07:45:05+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}