Is CVE-2026-34207 actively exploited?

No active exploitation of CVE-2026-34207 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-34207 be exploited remotely?

Yes. CVE-2026-34207 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-34207?

CVE-2026-34207 has a CVSS score of 7.6 (HIGH).

HOME VULNERABILITIESCVE-2026-34207

HIGH

CVE-2026-34207

CWE-20Published: May 22, 2026· Updated: May 22, 2026

7.6

CVSS v3.1

EPSS:0.05%probability of exploitation in 30 daysPercentile:16.7th

Official Description

TypeBot is a chatbot builder tool. In versions prior to 3.16.0, SSRF protection for Webhook / HTTP Request blocks validates only the URL string, blocked hostname literals, and literal IP formats. It does not resolve DNS before allowing the request. As a result, a hostname such as ssrf-repro.example that resolves to 127.0.0.1, 169.254.169.254, or RFC1918/private space passes validation and is later fetched by the backend HTTP client. This enables server-side request forgery to loopback, cloud metadata, and private network targets. This issue has been resolved in version 3.16.0.

NVD Source

Technical Analysis

CVE-2026-34207 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 7.6.