What is the CVSS score of CVE-2026-34207?

CVE-2026-34207 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Typebot are affected by CVE-2026-34207?

Typebot chatbot builder (versions prior to 3.16.0) contains a server-side request forgery vulnerability allowing authenticated users to access internal systems and cloud infrastructure that should be…

How to fix or mitigate CVE-2026-34207?

Within 24 hours: Audit all Typebot Webhook and HTTP Request block configurations to identify potential abuse vectors and enforce mandatory approval workflows for new integrations. Within 7 days: Upgrade all Typebot deployments to version 3.16.0 or later. Within 30 days: Review audit logs from the past 90 days for unusual internal or cloud metadata endpoint access attempts, and implement network egress controls restricting Typebot to approved external domains only.

Typebot CVE-2026-34207

HIGH

Improper Input Validation (CWE-20)

2026-05-22 GitHub_M

SSRF Typebot Io

7.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Source Code Evidence Fetched

May 22, 2026 - 17:45 vuln.today

Analysis Generated

May 22, 2026 - 17:45 vuln.today

DescriptionGitHub Advisory

TypeBot is a chatbot builder tool. SSRF protection for Webhook / HTTP Request blocks validates only the URL string, blocked hostname literals, and literal IP formats. It does not resolve DNS before allowing the request. As a result, a hostname such as ssrf-repro.example that resolves to 127.0.0.1, 169.254.169.254, or RFC1918/private space passes validation and is later fetched by the backend HTTP client. This enables server-side request forgery to loopback, cloud metadata, and private network targets. This issue has been resolved in version 3.16.0.

AnalysisAI

Server-side request forgery in Typebot chatbot builder versions prior to 3.16.0 allows authenticated users to bypass SSRF protections in Webhook and HTTP Request blocks by supplying attacker-controlled hostnames that resolve via DNS to loopback (127.0.0.1), cloud metadata (169.254.169.254), or RFC1918 private addresses. The validation logic only inspected the URL string and literal IP formats without performing DNS resolution, so a benign-looking domain could route the backend HTTP client to internal targets. No public exploit identified at time of analysis, though the GitHub Security Advisory and fix commit are publicly visible.

Technical ContextAI

Typebot is an open-source chatbot builder maintained by baptisteArno (CPE cpe:2.3:a:baptistearno:typebot.io). The vulnerable component is the HTTP Request integration block (packages/bot-engine/src/blocks/integrations/httpRequest/executeHttpRequestBlock.ts) which used the ky HTTP client directly against user-supplied URLs. The root cause maps to CWE-20 (Improper Input Validation): URL validation checked the textual form against a blocklist of literal hostnames and IP-formatted strings, but never resolved the hostname to its actual A/AAAA records before issuing the request. This is a classic DNS-rebinding-class SSRF gap where validation and resolution are decoupled. The fix introduces a safeKy wrapper that performs DNS resolution and rejects link-local (169.254.0.0/16), loopback, and private (e.g., 10.0.0.0/8) destinations, and additionally hardens against redirect-chain bypasses by validating each Location header before following with a maxRedirects cap of 10.

RemediationAI

Vendor-released patch: upgrade to Typebot 3.16.0 or later, which replaces the unguarded ky client with a safeKy wrapper that performs DNS resolution and blocks loopback, link-local, and RFC1918 destinations, and validates each redirect target (see commit https://github.com/baptisteArno/typebot.io/commit/23818bb0e54db23c456ee3fa6b12d82b2af848b8 and advisory https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-grcc-6x37-wwgp). If immediate upgrade is not possible, restrict the Typebot backend's network egress at the host or cloud layer by denying outbound traffic to 127.0.0.0/8, 169.254.0.0/16, 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 (trade-off: legitimate internal webhooks to these ranges will break), require IMDSv2 with hop-limit 1 on AWS to block cloud-metadata exfiltration via SSRF (trade-off: applications using IMDSv1 must be updated), and tighten account provisioning so only trusted authors can create HTTP Request/Webhook blocks since exploitation requires PR:L.