CVE-2026-110873 heymrun CVE debrief

Who should care

Defenders managing shared workflow environments, DevOps teams, and security personnel responsible for reviewing workflow configurations and ensuring secure credential handling should assess exposure and prioritize remediation.

Why it matters

CVE-2026-110873 is a high-severity vulnerability allowing shared collaborators to escalate privileges and potentially steal credentials. Defenders should prioritize verifying exposure, reviewing workflow configurations, and updating to version 0.0.121 or later.

• Credential theft through workflow manipulation
• Potential for lateral movement within shared workflow environments
• Need for verification of workflow configurations and error handling
• Priority for updating to version 0.0.121 or later

Technical summary

The vulnerability exists in Heym versions from 0.0.55 before 0.0.121. Shared collaborators can overwrite a workflow's error_workflow_id field, allowing attackers to manipulate the error workflow and potentially inject and exfiltrate decrypted credentials. This can occur when the parent workflow errors, and the owner's decrypted credentials are injected into the error workflow. The issue arises from the error_workflow_id field being missing from OWNER_ONLY_EXECUTION_FIELDS, enabling shared collaborators to escalate privileges.

Defensive priority

Defenders should prioritize verifying exposure in shared workflow environments, reviewing workflow configurations, and updating to version 0.0.121 or later.

Recommended defensive actions

• Verify exposure in shared workflow environments
• Review workflow configurations for error_workflow_id fields
• Update to version 0.0.121 or later
• Monitor for suspicious workflow activity
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and potential impact. However, additional information on exploitation or victim organizations is not available. Defenders should verify exposure in shared workflow environments, review workflow configurations for error_workflow_id fields, and update to version 0.0.121 or later. The source item and CVE record provide limited information on affected scope and severity. Further verification is required to confirm exposure and prioritize remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.