CVE-2026-34207: TypeBot: SSRF Protection Bypass via DNS-Resolved Hostnames in Webhook / HTTP Request Validation
TypeBot is a chatbot builder tool. In versions prior to 3.16.0, SSRF protection for Webhook / HTTP Request blocks validates only the URL string, blocked hostname literals, and literal IP formats. It does not resolve DNS before allowing the request. As a result, a hostname such as ssrf-repro.example that resolves to 127.0.0.1, 169.254.169.254, or RFC1918/private space passes validation and is later fetched by the backend HTTP client. This enables server-side request forgery to loopback, cloud metadata, and private network targets. This issue has been resolved in version 3.16.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TypeBotto a version that resolves this vulnerability.Fixed in 3.16.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34207?
CVE-2026-34207 has a high severity rating of 7.6.
How do I fix CVE-2026-34207?
To mitigate CVE-2026-34207, ensure that your TypeBot software is updated to the latest version where the SSRF protection has been improved.
What type of vulnerability is CVE-2026-34207?
CVE-2026-34207 is a Server-Side Request Forgery (SSRF) vulnerability.
What impact does CVE-2026-34207 have on TypeBot users?
CVE-2026-34207 allows unauthorized access to internal resources via malicious DNS-resolved hostnames.
Are there any known exploits for CVE-2026-34207?
As of now, there are no public reports of exploits specifically targeting CVE-2026-34207.