Server-Side Request Forgery Vulnerability in Heym Automated Systems
CVE-2026-67542

7.1HIGH

Key Information:

Vendor

Heymrun

Status
Heym
Vendor
CVE Published:
11 November 2026

What is CVE-2026-67542?

Heym Automated Systems allows authenticated users to access the endpoint /api/mcp/fetch-tools, leading to potential exploitation via server-side request forgery (SSRF). Before version 0.0.70, this endpoint permitted attackers to submit URLs without restrictions, exposing sensitive data via uncontrolled network requests. The vulnerability is compounded by the attacker’s ability to manipulate outbound request headers, presenting a significant risk to the integrity of the system. This issue has been addressed in version 0.0.70.

Affected Version(s)

heym < 0.0.70

References

https://github.com/heymrun/heym/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/heymrun/heym/commit/72954f1f6264f6260b...
x_refsource_MISC
https://github.com/heymrun/heym/releases/tag/0.0.70
x_refsource_MISC

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.