Is CVE-2026-39968 actively exploited?

No active exploitation of CVE-2026-39968 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-39968 be exploited remotely?

Yes. CVE-2026-39968 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-39968?

CVE-2026-39968 has a CVSS score of 7.1 (HIGH).

HOME VULNERABILITIESCVE-2026-39968

HIGH

CVE-2026-39968

CWE-284Published: May 22, 2026· Updated: May 26, 2026

7.1

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:11.1th

Official Description

TypeBot is a chatbot builder tool. In versions 3.15.2 and prior, the fix for GHSA-4xc5-wfwc-jw47 ("Credential Theft via Client-Side Script Execution and API Authorization Bypass") is incomplete. While the builder's getCredentials tRPC endpoint was patched with workspace membership checks, the bot-engine runtime still allows any authenticated user to use credentials from any workspace via the preview chat endpoint. The bot-engine's getCredentials() utility function uses a falsy check (if (workspaceId && ...)) for workspace ownership validation. Since the preview endpoint accepts a client-controlled workspaceId field and the Zod schema allows empty strings, an attacker can supply workspaceId: "" to bypass credential ownership verification entirely. Exploitation can result in credential exfiltration, external service abuse, financial damage and a data breach.

NVD Source

Technical Analysis

CVE-2026-39968 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 7.1.