Seven vulnerabilities disclosed in Heym agentic automation platform

GitHub Security Advisories published seven CVEs for Heym, a self-hosted agentic business-process automation platform with Model Context Protocol (MCP) support, on November 11, 2026. The most severe flaws let any authenticated user reach unsandboxed host command execution through MCP tool-fetching, Playwright code nodes, and skill execution, according to the Heym stdio transport arbitrary command execution advisory.

What the advisories cover

• CVE-2026-67546: arbitrary command execution via the stdio transport on POST /api/mcp/fetch-tools, CVSS 8.8, fixed in 0.0.75.
• CVE-2026-67543: unsandboxed skill code execution with no Docker isolation, granting host root access, fixed in 0.0.70.
• CVE-2026-67544: remote code execution via the Playwright node's playwrightCode field, fixed in 0.0.71.
• CVE-2026-67542: server-side request forgery (SSRF) via POST /api/mcp/fetch-tools, exploitable by any authenticated user.
• CVE-2026-67545: SSRF in the HTTP workflow node with no target-host validation, fixed in 0.0.73.
• CVE-2026-67541: missing admin or creator role gate on team-member management, exposing shared credentials, fixed in 0.0.70.

What it means for people who build with AI

Heym is a textbook example of an agent-builder platform where MCP tool-fetching, custom-code nodes, and skill execution were not isolated from the host, the kind of RCE-by-design risk increasingly found in self-hosted agent orchestration tools. The most severe issues let any authenticated, low-privileged user reach unsandboxed host command execution. Teams running self-hosted Heym instances should apply the fixes released across versions 0.0.70 through 0.0.75.

Sources

• Heym stdio transport arbitrary command execution (GitHub Security Advisories, November 11, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.