CVE-2026-101049
MEDIUMCVSS 6.5Description
Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential IDs or have empty signing secrets. Remote unauthenticated attackers can send forged Slack events to known webhook URLs to trigger workflows with the owner's credentials.
Timeline
Published:September 27th, 2026 5:16 PM
Last modified:September 28th, 2026 9:02 PM
CVSS Scoring
CVSS v3: 6.5 (MEDIUM)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
Weaknesses (CWE)
References & Reports
Advisories, patches, and third-party reports
- https://github.com/heymrun/heym/commit/341d1012367cd74f85c617e1c98dd49e3fcb5e83
- https://github.com/heymrun/heym/security/advisories/GHSA-pm6h-x3h5-j38h
- https://www.vulncheck.com/advisories/heym-before-0.0.53-slack-webhook-signature-verification-bypass
- https://github.com/heymrun/heym/security/advisories/GHSA-pm6h-x3h5-j38h
Source: NIST NVD · Data may lag official sources by up to one minute