Read the docs
TI-2026-74563 Aliases CVE-2026-110873

Heym credential theft via error_workflow_id field overwrite

Priority LOW 31CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Heym from 0.0.55 before 0.0.121 lets shared collaborators overwrite a workflow's error_workflow_id because the field is missing from OWNER_ONLY_EXECUTION_FIELDS, an authorization flaw (CWE-863). An attacker with collaborator access can point the error workflow to their own workflow with an HTTP node. When the parent workflow errors, the owner's decrypted credentials are injected into that workflow and exfiltrated.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow's error_workflow_id because the field is missing from OWNER_ONLY_EXECUTION_FIELDS. Attackers can point the error workflow to their own workflow with an HTTP node, and when the parent workflow errors the owner's decrypted credentials are injected and exfiltrated.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00213 11th percentileScored 2026-11-07
Fix Fixed heym (heymrun): 0.0.121

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
heymrunheym0.0.55 to before 0.0.1210.0.121Patch availableCNA
  • heym Vendorheymrun Affected 0.0.55 to before 0.0.121 Fixed in 0.0.121 Patch available CNA

Remediation

Update Heym to version 0.0.121 or later, which is the fixed version listed for heymrun heym.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA heym (heymrun) Fixed in 0.0.121

Timeline

  1. 2026-10-15 Threatist record created from CVE-2026-110873
  2. 2026-10-16 Priority changed: MEDIUM → LOW
  3. 2026-10-16 CISA SSVC decision points changed

References

Advisory 1

  • TI-2026-71768 Sandbox escape in heym Python tool allows command execution CVSS 3.1HIGH 8.8
  • TI-2026-65003 Heym before 0.0.53 Remote Code Execution via eval() Sandbox Escape CVSS 4.0HIGH 8.7
  • TI-2026-65002 heym before 0.0.91 Remote Code Execution via Expression Engine CVSS 4.0HIGH 8.7
  • TI-2026-33042 Heym < 0.0.21 Sandbox Escape via Python Introspection CVSS 4.0HIGH 8.7
  • TI-2026-65083 Heym before 0.0.53 Authentication Bypass via Telegram Webhook CVSS 4.0HIGH 8.3
  • TI-2026-65082 Heym before 0.0.53 Slack Webhook Signature Verification Bypass CVSS 4.0HIGH 8.3
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences