CVE-2026-67546

The Heym agentic systems and business-process automation platform is vulnerable to arbitrary command execution via the POST /api/mcp/fetch-tools endpoint in versions prior to 0.0.75 . An authenticated user with the lowest role can exploit this by providing a stdio transport , which causes the sys...