heymrun heym up to 0.0.90 missing encryption

Summaryinfo

A vulnerability described as problematic has been identified in heymrun heym up to 0.0.90. Impacted is an unknown function. Executing a manipulation can lead to missing encryption. This vulnerability is registered as CVE-2026-100862. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in heymrun heym up to 0.0.90 and classified as problematic. This vulnerability affects an unknown code block. The manipulation with an unknown input leads to a missing encryption vulnerability. The CWE definition for the vulnerability is CWE-311. The product does not encrypt sensitive or critical information before storage or transmission. As an impact it is known to affect confidentiality. CVE summarizes:

heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets include webhook header-auth values (returned in cleartext by GET /api/workflows/{id} and persisted unsanitized into execution history), MCP API keys (stored as a plaintext column, returned in config/list responses, and accepted via the ?key= query string so they leak into logs, proxies and Referer headers), portal session tokens (stored and validated by plaintext equality with a 168-hour TTL), workflow execution JWTs (stored in full and re-listed by GET .../execution-tokens), Discord interaction tokens (the full interaction body is stored in execution history), and global variables. A user with read access to a workflow, share/team membership, or anyone able to read the database, a backup, or logs can recover these secrets and replay them to execute workflows or act as the secret owner.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-100862 since 09/27/2026. The exploitation appears to be difficult. The attack can be initiated remotely. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1600.

Upgrading to version 0.0.91 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-87827). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• heymrun

Name

• heym

Version

• 0.0.1
• 0.0.2
• 0.0.3
• 0.0.4
• 0.0.5
• 0.0.6
• 0.0.7
• 0.0.8
• 0.0.9
• 0.0.10
• 0.0.11
• 0.0.12
• 0.0.13
• 0.0.14
• 0.0.15
• 0.0.16
• 0.0.17
• 0.0.18
• 0.0.19
• 0.0.20
• 0.0.21
• 0.0.22
• 0.0.23
• 0.0.24
• 0.0.25
• 0.0.26
• 0.0.27
• 0.0.28
• 0.0.29
• 0.0.30
• 0.0.31
• 0.0.32
• 0.0.33
• 0.0.34
• 0.0.35
• 0.0.36
• 0.0.37
• 0.0.38
• 0.0.39
• 0.0.40
• 0.0.41
• 0.0.42
• 0.0.43
• 0.0.44
• 0.0.45
• 0.0.46
• 0.0.47
• 0.0.48
• 0.0.49
• 0.0.50
• 0.0.51
• 0.0.52
• 0.0.53
• 0.0.54
• 0.0.55
• 0.0.56
• 0.0.57
• 0.0.58
• 0.0.59
• 0.0.60
• 0.0.61
• 0.0.62
• 0.0.63
• 0.0.64
• 0.0.65
• 0.0.66
• 0.0.67
• 0.0.68
• 0.0.69
• 0.0.70
• 0.0.71
• 0.0.72
• 0.0.73
• 0.0.74
• 0.0.75
• 0.0.76
• 0.0.77
• 0.0.78
• 0.0.79
• 0.0.80
• 0.0.81
• 0.0.82
• 0.0.83
• 0.0.84
• 0.0.85
• 0.0.86
• 0.0.87
• 0.0.88
• 0.0.89
• 0.0.90

Website

• Product: https://github.com/heymrun/heym/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion