---
id: CVE-2026-84207
title: >-
  Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and
  WebSocket Trigger nodes, allowing authenticated users to connect to internal
  services
summary: >-
  Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and
  WebSocket Trigger nodes, allowing authenticated users to connect to internal
  services. Attackers can craft workflow nodes with arbitrary URLs and headers
  to reach…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-918
published: '2026-09-01'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:18:59.270'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84207'
references:
  - url: 'https://github.com/heymrun/heym'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/heymrun/heym/blob/v0.0.97/backend/app/services/websocket_trigger_service.py
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/heymrun/heym/blob/v0.0.97/backend/app/services/websocket_utils.py
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/heymrun/heym/commit/540aade7c7495295062f32f4dfd0d6805f066f0c
    label: disclosure@vulncheck.com
  - url: 'https://github.com/heymrun/heym/releases/tag/v0.0.98'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/heymrun/heym/security/advisories/GHSA-mqw6-g845-w596'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/heym-before-0.0.98-ssrf-via-websocket-endpoints
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.002
epssPercentile: 0.10236
ingestedAt: '2026-09-08T21:11:12.289Z'
---

## Overview

Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes, allowing authenticated users to connect to internal services. Attackers can craft workflow nodes with arbitrary URLs and headers to reach internal services and read responses from the WebSocket Trigger node.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.