Medium severity · published Sep 27, 2026
CVE-2026-101049
Heym before 0.0.53 Slack Webhook Signature Verification Bypass
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential IDs or have empty signing secrets. Remote unauthenticated attackers can send forged Slack events to known webhook URLs to trigger workflows with the owner's credentials.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HE
heym · heymrun
before 0.0.53 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-101049
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-101049
vendor-advisory
https://github.com/heymrun/heym/security/advisories/GHSA-pm6h-x3h5-j38h
patch
https://github.com/heymrun/heym/commit/341d1012367cd74f85c617e1c98dd49e3fcb5e83
third-party-advisory
https://www.vulncheck.com/advisories/heym-before-0.0.53-slack-webhook-signature-verification-bypass
More from heym
8.8
CVE-2026-55376
heym Python Tool Sandbox Escape
8.8
CVE-2026-100865
Heym before 0.0.53 Remote Code Execution via eval() Sandbox Escape
8.8
CVE-2026-100864
heym before 0.0.91 Remote Code Execution via Expression Engine
8.8
CVE-2026-45227
Heym < 0.0.21 Sandbox Escape via Python Introspection
7.6
CVE-2026-45225
Heym < 0.0.21 Path Traversal File Upload via upload_file()