Is CVE-2026-34746 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34746 being exploited in the wild.

How severe is CVE-2026-34746?

High severity, with a CVSS score of 7.7, published 1 April 2026.

Which products and versions are affected?

payload (npm) SEMVER:introduced=0,fixed=3.79.1; Payload CMS < 3.79.1.

Is there a fix for CVE-2026-34746?

Yes. payload (npm): upgrade to 3.79.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34746 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-34746?

Check whether you run payload (npm), Payload CMS or PayloadCMS Payload at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34746: Payload CMS authenticated SSRF in upload functionality

Q: Is there a fix for CVE-2026-34746?

Yes. payload (npm): upgrade to 3.79.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-34746 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-34746?

Check whether you run payload (npm), Payload CMS or PayloadCMS Payload at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34746 · Severity: high · CVSS 7.7 · Published 2026-04-01

Payload is an open-source headless CMS used to manage and deliver content. An authenticated user with permission to upload files to a collection could exploit this vulnerability to trick the server into making HTTP requests to arbitrary internal or external URLs, potentially exposing sensitive internal services or data.

Technologies: payload (npm), Payload CMS, PayloadCMS Payload. Vendors: npm, Payload, PayloadCMS.

Quick answers

Is CVE-2026-34746 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34746 being exploited in the wild.
How severe is CVE-2026-34746?: High severity, with a CVSS score of 7.7, published 1 April 2026.
Which products and versions are affected?: payload (npm) SEMVER:introduced=0,fixed=3.79.1; Payload CMS < 3.79.1.
Is there a fix for CVE-2026-34746?: Yes. payload (npm): upgrade to 3.79.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34746 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-34746?: Check whether you run payload (npm), Payload CMS or PayloadCMS Payload at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

payload (npm): upgrade to 3.79.1 or later
```
npm install payload@3.79.1
```

Technical details

The vulnerability is a Server-Side Request Forgery (CWE-918) in Payload's upload functionality that allows authenticated users to cause the server to make outbound HTTP requests to arbitrary URLs. The attack requires authentication and valid create or update access to an upload-enabled collection, with no user interaction required. An attacker can leverage this to access internal services, exfiltrate data, or interact with restricted network resources. The vulnerability has been patched in version 3.79.1; users must upgrade immediately to remediate.

Affected products

Payload Payload CMS < 3.79.1

Identifiers

CVE-2026-34746
GHSA-6r7f-q7f5-wpx8

Timeline

2026-04-01: disclosed: Vulnerability published as GHSA-6r7f-q7f5-wpx8
2026-04-01: patched: Fix released in version 3.79.1

References

https://github.com/payloadcms/payload/security/advisories/GHSA-6r7f-q7f5-wpx8

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.