CVE-2026-67542

MCP tool discovery could make requests into a private network

Heym · Heym MCP network discovery

First documented disclosure · Review checkpoint

Summary

The discovery service accepted remote destinations without adequately confining outbound requests. Internal services could receive requests from the Heym backend.

Severity and exploitation evidence

High · 7.1/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The discovery service accepted remote destinations without adequately confining outbound requests.

Conditions required

An authenticated account could use the network-based MCP discovery transports.

Potential impact

Internal services could receive requests from the Heym backend.

Affected versions and configurations

Before 0.0.70.

Fix and mitigation status

The July advisory lists 0.0.59 as patched. The November CNA names 0.0.70 as corrected. Use 0.0.70 or later.

Practical next steps

Upgrade Heym and restrict egress from discovery workers.

Operating lesson

Apply authorization and isolation to every backend path that can act on behalf of an agent.

Evidence and limits

The July advisory lists 0.0.59 as patched. The November CNA names 0.0.70 as corrected. The public disclosure was on 2026-07-05. The CVE record was published on 2026-11-11.

Sources