CVE-2026-100862

🗓️ 27 Sep 2026 01:28:51Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 27 Views🌐 WEB

heym before 0.0.91 stores and returns multiple capability secrets in plaintext.

Reporter	Title	Published	Views	Family All 6
Cvelist	CVE-2026-100862 heym before 0.0.91 Multiple Secrets Plaintext Storage	27 Sep 202601:28	–	cvelist
EUVD	EUVD-2026-87827	27 Sep 202601:28	–	euvd
Mend	CVE-2026-100862	27 Sep 202601:28	–	mend
NVD	CVE-2026-100862	27 Sep 202602:17	–	nvd
Positive Technologies	PT-2026-99482	27 Sep 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-100862: Cleartext Storage of Sensitive Information	27 Sep 202600:00	–	rapid7

Vulners

Node

heymrun heymRange0–0.0.91

[
  {
    "vendor": "heymrun",
    "product": "heym",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "versionType": "semver",
        "lessThan": "0.0.91"
      },
      {
        "version": "0.0.91",
        "status": "unaffected",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
vulncheck	www.vulncheck.com/advisories/heym-before-0.0.91-multiple-secrets-plaintext-storage
github	www.github.com/heymrun/heym/security/advisories/GHSA-6x65-w7q7-wg93

Parameter	Position	Path	Description	CWE
id	path	/api/workflows/{id}	GET /api/workflows/{id} returns secrets stored in plaintext	CWE-312
key	query param	/config/list	config/list responses include MCP API keys in plaintext leaked via ?key= query parameter	CWE-312

30 Sep 2026 16:17Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.14.9

CVSS 46.9

EPSS0.00194

CWE-312