// SlackMEDIUM
CVE-2026-101049 in Heym before 0.0.53 allows remote unauthenticated attackers to forge Slack webhook events by bypassing signature verification when trigger nodes lack credential IDs or have empty signing secrets. Attackers can invoke workflows with the webhook owner's credentials without authentication. The vulnerability has a CVSS score of 6.5 and affects any Slack workspace using vulnerable Heym versions.
// Get alerts for Slack