Is CVE-2026-101049 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-101049?

CVE-2026-101049 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-101049

Description

Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential IDs or have empty signing secrets. Remote unauthenticated attackers can send forged Slack events to known webhook URLs to trigger workflows with the owner's credentials.