---
id: "CVE-2026-67546"
page: "https://infrastack.ai/live/CVE-2026-67546"
kind: "vulnerability"
aliases: ["CVE-2026-67546"]
title: "Heym: any logged-in user can run commands on the server"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "heym", "mcp", "self-hosted"]
not_affected_if: ["version-0.0.75-or-later"]
published_at: "2026-11-11T22:17:29+00:00"
first_seen_at: "2026-11-11T22:29:35+00:00"
updated_at: "2026-11-11T22:31:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-67546", "first_seen_at": "2026-11-11T22:29:35+00:00"}]
exploit_sources: []
---

# Heym: any logged-in user can run commands on the server

Link for people: https://infrastack.ai/live/CVE-2026-67546 (this .md is for agents)

Heym's MCP fetch-tools endpoint accepts the stdio transport, which spawns an attacker-supplied command with attacker-supplied arguments and environment on the backend host. Any authenticated user, including the lowest role, can execute code on the shared server before MCP validation fails.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Heym version and confirm it is below `0.0.75`
- Review whether POST /api/mcp/fetch-tools is reachable by ordinary authenticated users

## Fix

- Heym: upgrade to `0.0.75` or later

## Timeline

- 2026-11-11T22:29:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-67546

## Documents

- [advisory] Vendor advisory: github.com https://github.com/heymrun/heym/security/advisories/GHSA-378x-q589-34mv
- [fix] Patch: github.com https://github.com/heymrun/heym/commit/22b8ee60eb92128cf4ff04a9b6c0e1b62bf25a01
- [fix] Patch: github.com https://github.com/heymrun/heym/commit/6c6213f88dfa8b2a70d23a9a271171241e910904
- [fix] Release notes: github.com https://github.com/heymrun/heym/releases/tag/v0.0.75

## From the sources

Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.75, the same POST /api/mcp/fetch-tools endpoint (any authenticated user, lowest role) also accepts the stdio transport, which spawns the attacker-supplied command with attacker-supplied args and an environment merged over os.environ. The process executes on the shared backend host before MCP protocol validation fails — so side effects fire regardless of whether the command speaks MCP. This is a distinct weakness class and exploit primitive from the SSRF (Advisory 2) on the same endpoint, and needs a different fix (role gating / opt-in trust boundary rather than egress controls). This issue has been patched in version 0.0.75.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_