Typebot CVE-2026-34207
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconRegister or use low-privileged Typebot account
-
DeliveryCreate flow with HTTP Request block
-
ExploitPoint block at attacker-controlled hostname resolving to 169.254.169.254
-
InstallTrigger flow execution
-
C2Backend resolves DNS and fetches metadata endpoint
-
ExecuteCapture IAM credentials in bot response
-
ImpactPivot to cloud account using stolen credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires an authenticated Typebot account (CVSS PR:L) with permission to create or edit a flow that includes an HTTP Request or Webhook block, and the Typebot backend must be deployed in an environment where loopback, link-local, or RFC1918 addresses host sensitive services - for example a cloud VM with reachable instance-metadata at 169.254.169.254, an internal admin service on 127.0.0.1, or reachable RFC1918 peers. The attacker must also control DNS for a hostname (or use a public DNS rebinding/redirect-to-internal service) so the chosen name resolves to the targeted internal address. Limiting factors: no anonymous exploitation, and deployments with strict egress filtering or IMDSv2-with-hop-limit-1 substantially reduce realistic impact even on vulnerable versions. |
| Impact | CVSS 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) reflects network reachability with low attack complexity and low-privileged authentication - meaning any user able to author or trigger an HTTP Request/Webhook block can exploit this, which on self-hosted or multi-tenant Typebot deployments is a real threat. The high confidentiality impact is justified: cloud-metadata SSRF on AWS/GCP/Azure-hosted instances can leak IAM credentials. EPSS and KEV data were not provided in the input; the vulnerability is not listed as actively exploited and no POC URL is supplied. The PR:L requirement and the need to author bot flows limits drive-by mass exploitation but does not protect SaaS deployments where signup is open. Overall this is a credible priority for any Typebot operator running in a cloud environment with reachable metadata endpoints, with somewhat less urgency for tightly access-controlled on-prem deployments. |
| Exploit ScenarioDerived | An attacker with a low-privileged Typebot account creates a flow containing an HTTP Request block pointing at an attacker-controlled domain such as ssrf-repro.example whose DNS A record resolves to 169.254.169.254. When the backend executes the block, validateHttpReqUrl approves the string-form hostname, then the ky client resolves DNS and fetches the AWS instance metadata endpoint, returning IAM role credentials in the response body that the attacker captures via the bot's response handling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 22, 2026
Server-side request forgery in Typebot chatbot builder versions prior to 3.16.0 allows authenticated users to bypass SSRF protections in Webhook and HTTP Request blocks by supplying attacker-controlled hostnames that resolve via DNS to loopback (127.0.0.1), cloud metadata (169.254.169.254), or RFC1918 private addresses. The validation logic only inspected the URL string and literal IP formats without performing DNS resolution, so a benign-looking domain could route the backend HTTP client to internal targets. No public exploit identified at time of analysis, though the GitHub Security Advisory and fix commit are publicly visible.
RemediationAI
Vendor-released patch: upgrade to Typebot 3.16.0 or later, which replaces the unguarded ky client with a safeKy wrapper that performs DNS resolution and blocks loopback, link-local, and RFC1918 destinations, and validates each redirect target (see commit https://github.com/baptisteArno/typebot.io/commit/23818bb0e54db23c456ee3fa6b12d82b2af848b8 and advisory https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-grcc-6x37-wwgp). If immediate upgrade is not possible, restrict the Typebot backend's network egress at the host or cloud layer by denying outbound traffic to 127.0.0.0/8, 169.254.0.0/16, 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 (trade-off: legitimate internal webhooks to these ranges will break), require IMDSv2 with hop-limit 1 on AWS to block cloud-metadata exfiltration via SSRF (trade-off: applications using IMDSv1 must be updated), and tighten account provisioning so only trusted authors can create HTTP Request/Webhook blocks since exploitation requires PR:L.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Typebot is an open-source chatbot builder maintained by baptisteArno (CPE cpe:2.3:a:baptistearno:typebot.io). The vulnerable component is the HTTP Request integration block (packages/bot-engine/src/blocks/integrations/httpRequest/executeHttpRequestBlock.ts) which used the ky HTTP client directly against user-supplied URLs. The root cause maps to CWE-20 (Improper Input Validation): URL validation checked the textual form against a blocklist of literal hostnames and IP-formatted strings, but never resolved the hostname to its actual A/AAAA records before issuing the request. This is a classic DNS-rebinding-class SSRF gap where validation and resolution are decoupled. The fix introduces a safeKy wrapper that performs DNS resolution and rejects link-local (169.254.0.0/16), loopback, and private (e.g., 10.0.0.0/8) destinations, and additionally hardens against redirect-chain bypasses by validating each Location header before following with a maxRedirects cap of 10.
Know when Typebot Io gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
DescriptionCVE.org
TypeBot is a chatbot builder tool. SSRF protection for Webhook / HTTP Request blocks validates only the URL string, blocked hostname literals, and literal IP formats. It does not resolve DNS before allowing the request. As a result, a hostname such as ssrf-repro.example that resolves to 127.0.0.1, 169.254.169.254, or RFC1918/private space passes validation and is later fetched by the backend HTTP client. This enables server-side request forgery to loopback, cloud metadata, and private network targets. This issue has been resolved in version 3.16.0.
Executive ViewAI
Typebot chatbot builder (versions prior to 3.16.0) contains a server-side request forgery vulnerability allowing authenticated users to access internal systems and cloud infrastructure that should be inaccessible. Organizations using Typebot for customer-facing chatbots risk unauthorized access to internal resources, cloud metadata, and private networks if internal integrations are configured. Upgrading to version 3.16.0 is required to remediate this exposure.
Apply vendor patch: upgrade Typebot to version 3.16.0 or later. Interim mitigation if upgrade is delayed: implement network segmentation and Zero Trust access controls on sensitive internal services, and restrict Typebot's outbound connections via egress filtering to approved external endpoints only.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Affected Products (CPE)CVE.org
More in Typebot Io
View allServer-Side Request Forgery in Typebot chatbot builder versions 3.15.2 and prior allows unauthenticated remote attackers
Cross-workspace OAuth credential takeover in Typebot (open-source chatbot builder) before 3.17.0 lets a user holding onl
Unauthenticated cross-tenant file upload in Typebot.io chatbot builder versions 3.16.1 and earlier allows anonymous visi
Cleartext storage of API bearer tokens in the self-hosted open-source Typebot chatbot builder (version 3.16.1) lets anyo
Stored cross-site scripting in Typebot chatbot builder versions 3.15.2 and prior allows a malicious imported or collabor
Stored cross-site scripting in Typebot (chatbot builder) versions 3.15.2 and prior lets an authenticated user upload a c
Unauthenticated S3 path traversal in Typebot versions prior to 3.17.0 allows any attacker to obtain presigned S3 PUT URL
Server-side request forgery in Typebot chatbot builder before version 3.17.2 allows remote unauthenticated attackers to
Server-side request forgery in Typebot before 3.17.2 lets an authenticated workspace editor or creator bypass the shared
Server-side request forgery in Typebot versions 3.15.2 and prior allows authenticated users to bypass the validateHttpRe
Credential exfiltration in Typebot prior to 3.17.0 allows a low-privilege guest workspace member to steal decrypted Open
Typebot's webhook resume endpoint exposes an insecure direct object reference flaw that allows any authenticated user ho
Exploit-DB