CVE-2026-100862
Received Received - Intake

Heym Plaintext Secrets Exposure in Workflow Automation

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: VulnCheck

Description
heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets include webhook header-auth values (returned in cleartext by GET /api/workflows/{id} and persisted unsanitized into execution history), MCP API keys (stored as a plaintext column, returned in config/list responses, and accepted via the ?key= query string so they leak into logs, proxies and Referer headers), portal session tokens (stored and validated by plaintext equality with a 168-hour TTL), workflow execution JWTs (stored in full and re-listed by GET .../execution-tokens), Discord interaction tokens (the full interaction body is stored in execution history), and global variables. A user with read access to a workflow, share/team membership, or anyone able to read the database, a backup, or logs can recover these secrets and replay them to execute workflows or act as the secret owner.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-100862
EUVD
EUVD-2026-87827

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
heym workflow_automation_platform to 0.0.91 (exc)
heym heym to 0.0.91 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-312 The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the heym workflow automation platform versions prior to 0.0.91. Multiple types of secrets are stored and returned in plaintext, including webhook header-auth values, MCP API keys, portal session tokens, workflow execution JWTs, Discord interaction tokens, and global variables. These secrets can be exposed through API responses, execution history, logs, or database access.

Detection Guidance

Check API responses for plaintext secrets by inspecting GET /api/workflows/{id} for webhook headers and execution history. Search logs, database backups, or browser history for MCP API keys passed via ?key= query strings. Review execution history for stored Discord tokens or workflow execution JWTs. Use database queries to verify if secrets like session tokens or global variables are stored in plaintext.

Impact Analysis

An attacker with read access to workflows, team membership, or database access could recover these secrets and replay them to execute workflows or act as the secret owner. This could lead to unauthorized actions, data breaches, or misuse of sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Exposure of secrets like API keys, tokens, and passwords may result in non-compliance with data protection regulations.

Mitigation Strategies

Upgrade to heym version 0.0.91 or later to address some issues. Hash secrets at rest using SHA-256 and implement proper sanitization for API responses. Restrict access to workflows, team memberships, and databases. Avoid passing secrets via query strings and review logs for exposed credentials. Rotate all exposed secrets immediately.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100862. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart