{"id":"CVE-2026-101050","aliases":["EUVD-2026-87970","GHSA-2x2v-2gpw-j9ff","GHSA-pm6h-x3h5-j38h"],"status":"published","title":"Heym before 0.0.53 Authentication Bypass via Telegram Webhook","description":"Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credential_id is absent or secret_token is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execute actions on attacker-supplied input.","severity":{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-07","score":0.0038,"percentile":0.32217,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287","CWE-94"],"published":"2026-09-27T01:28:53.874Z","modified":"2026-10-28T02:31:06Z","products":[{"vendor":"heymrun","product":"heym"}],"references":[{"url":"https://github.com/heymrun/heym/security/advisories/GHSA-pm6h-x3h5-j38h","tags":["vendor-advisory","exploit","advisory"]},{"url":"https://github.com/heymrun/heym/commit/341d1012367cd74f85c617e1c98dd49e3fcb5e83","tags":["patch","fix"]},{"url":"https://www.vulncheck.com/advisories/heym-before-0.0.53-authentication-bypass-via-telegram-webhook","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101050","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2x2v-2gpw-j9ff"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100865.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100865","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101049.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101049","tags":["advisory"]},{"url":"https://www.vulncheck.com/advisories/heym-before-0.0.53-slack-webhook-signature-verification-bypass","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101050.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-101050","title":"Heym before 0.0.53 Authentication Bypass via Telegram Webhook","description":"Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credential_id is absent or secret_token is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execute actions on attacker-supplied input.","status":"published","published":"2026-09-27T16:28:28.766Z","modified":"2026-09-28T13:14:37.706Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:20:09.448255Z"}],"euvd":[{"id":"EUVD-2026-87970","description":"Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credential_id is absent or secret_token is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execute actions on attacker-supplied input.","status":"published","published":"2026-09-27T16:28:28Z","modified":"2026-09-28T13:14:37Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:27:53.908541Z"}],"ghsa":[{"id":"GHSA-2x2v-2gpw-j9ff","title":"Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook...","description":"Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credential_id is absent or secret_token is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execute actions on attacker-supplied input.","status":"published","published":"2026-09-27T18:30:22Z","modified":"2026-09-27T18:30:34Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:12:31.359269Z"}],"nvd":[{"id":"CVE-2026-101050","description":"Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credential_id is absent or secret_token is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execute actions on attacker-supplied input.","status":"published","published":"2026-09-27T17:16:56.1Z","modified":"2026-09-28T20:57:50.143Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:12:52.081323Z"}],"osv":[{"id":"CVE-2026-100865","title":"Heym before 0.0.53 Remote Code Execution via eval() Sandbox Escape","description":"Heym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the workflow executor service. Authenticated users can edit workflow condition nodes or import malicious templates to execute arbitrary Python and OS commands as the backend process user.","status":"published","published":"2026-09-27T01:28:53.874Z","modified":"2026-10-28T02:30:59.398161771Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:44:53.83521Z"},{"id":"CVE-2026-101049","title":"Heym before 0.0.53 Slack Webhook Signature Verification Bypass","description":"Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential IDs or have empty signing secrets. Remote unauthenticated attackers can send forged Slack events to known webhook URLs to trigger workflows with the owner's credentials.","status":"published","published":"2026-09-27T16:28:28.128Z","modified":"2026-10-28T02:31:04.459017075Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:44:53.83521Z"},{"id":"CVE-2026-101050","title":"Heym before 0.0.53 Authentication Bypass via Telegram Webhook","description":"Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credential_id is absent or secret_token is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execute actions on attacker-supplied input.","status":"published","published":"2026-09-27T16:28:28.766Z","modified":"2026-10-28T02:31:06.647648794Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:44:53.83521Z"}]}}