SSRF Vulnerability in Heym's HTTP Workflow Node

CVE-2026-67545

What is CVE-2026-67545?

The HTTP workflow node in Heym, which is used for building agentic systems and automating business processes, has a flaw that allows it to make outbound HTTP requests to user-provided URLs without proper validation of the target host or IP address. This vulnerability can be exploited if a workflow author configures an HTTP node targeting internal addresses, such as cloud metadata endpoints. If such a workflow is exposed for anonymous execution, an unauthenticated attacker can exploit the configured SSRF sink to gain unauthorized access. It is important to note that while the Heym project includes extensive SSRF protections in its MCP integration, these measures are not replicated in the HTTP node, leading to potential exposure before this issue was addressed in version 0.0.73.

References