Typebot CVE-2026-33712

No special conditions - remote unauthenticated exploitation against default configurations of Typebot 3.15.2 and earlier, requiring only network reachability to the preview chat endpoint POST /api/v1/typebots/{typebotId}/preview/startChat and the ability to submit a custom typebot definition containing a server-side code block that calls the sandbox fetch function. Limiting factors are minimal: no authentication, no user interaction, and no non-default configuration is required; the only practical constraint is that the attacker must be able to reach the Typebot HTTP endpoint, and the value of SSRF targets depends on what internal services or cloud metadata endpoints are reachable from the Typebot server's network position.

All risk signals align toward maximum urgency: CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N indicates a network-exploitable, low-complexity, unauthenticated attack with no user interaction and a changed scope reaching beyond the vulnerable component (e.g., into cloud metadata services or internal networks). The base score of 10.0 is driven by the scope change and high confidentiality and integrity impact. No EPSS score, KEV listing, or POC was provided in the intelligence inputs, so exploitation in the wild is not confirmed; however, the vendor advisory explicitly describes credential theft and internal network access as realistic outcomes. The relatively low public visibility versus extreme technical severity suggests this is a real priority for any Typebot operator, particularly cloud-hosted deployments where IMDS access enables credential pivot.

An unauthenticated attacker sends a POST to /api/v1/typebots/{typebotId}/preview/startChat with a crafted typebot definition that includes a server-side code block invoking the sandbox's fetch against http://169.254.169.254/latest/meta-data/iam/security-credentials/ on AWS or an equivalent cloud metadata URL. The response is returned through the chat flow, exposing temporary IAM credentials that the attacker uses to pivot into the victim's cloud account, or alternatively the attacker scans internal IP ranges and exfiltrates data from internal services that trust the Typebot host's network position.