CVE-2026-100860

heym before 0.0.105 does not act on the result of the credential authorization lookup in the Redis workflow node (backend/app/services/node_execution/nodes/redis_node.py). When _get_accessible_credential returns None — because the credential ID does not exist or the caller is not authorized to use it — the node treats the lookup failure as an empty configuration and falls back to defaults, connecting to localhost:6379 with no password and executing the requested operation there. The same fallback occurs when an accessible credential has an empty config or no redis_host value. An authenticated workflow author who supplies a credential ID they do not own, or one that was deleted, therefore obtains a read/write connection to whatever Redis is listening on the backend's loopback interface instead of an error. Impact depends on the deployment: the stock docker-compose.yml ships no Redis, in which case the flaw surfaces as a misleading connection error rather than data exposure.

• CWE-636

• https://github.com/heymrun/heym/security/advisories/GHSA-fmpw-hj3m-xvj6
• https://www.vulncheck.com/advisories/heym-before-0.0.105-authentication-bypass-via-redis-node

Published

Sep 27, 2026

Last Modified

Sep 27, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-100855AzuraCast before 0.23.6 contains a missing permission check …6.5
• CVE-2026-100856AzuraCast before 0.23.6 contains a code injection vulnerabil…8.8
• CVE-2026-100857AzuraCast before 0.23.4 contains a code injection vulnerabil…8
• CVE-2026-100858heym before 0.0.109 contains a server-side request forgery v…6.8
• CVE-2026-100859Heym before 0.0.106 contains a credential exfiltration vulne…6.5
• CVE-2026-10086GitLab has remediated an issue in GitLab EE affecting all ve…5.4
• CVE-2026-100861heym before 0.0.105 fails to apply egress guards to integrat…5
• CVE-2026-100862heym, a workflow automation platform, stores and returns mul…4.9
• CVE-2026-100863Heym versions 0.0.90 and earlier contain two server-side req…5
• CVE-2026-100864heym before 0.0.91 contains a sandbox escape vulnerability i…8.8
• CVE-2026-100865Heym before 0.0.53 contains multiple independent vulnerabili…8.8
• CVE-2026-10087GitLab has remediated an issue in GitLab EE affecting all ve…8.7