What is the CVSS score of CVE-2026-39965?

CVE-2026-39965 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Typebot are affected by CVE-2026-39965?

Typebot versions 3.15.2 and earlier contain a server-side request forgery vulnerability that permits authenticated users to steal AWS IAM credentials and access private cloud infrastructure by…

How to fix or mitigate CVE-2026-39965?

24 hours: Inventory all Typebot deployments and verify version numbers. 7 days: Upgrade all instances to Typebot 3.16.0 or later. 30 days: Audit IAM credential audit logs for unauthorized access patterns and validate no credentials were exfiltrated during exposure window.

Typebot CVE-2026-39965

HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-22 GitHub_M

Open Redirect SSRF Typebot Io

7.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

May 22, 2026 - 18:15 vuln.today

Analysis Generated

May 22, 2026 - 18:15 vuln.today

DescriptionGitHub Advisory

TypeBot is a chatbot builder tool. Versions 3.15.2 and prior contain an SSRF via Open Redirect Bypass as the HTTP Request block and Code block validate the initial request URL via validateHttpReqUrl() to block private IPs and cloud metadata hostnames. However, the HTTP clients (ky and fetch) follow 302 redirects without re-validating the redirect destination. An authenticated user can point a bot block to an attacker-controlled server that responds with a redirect to an internal IP, causing the Typebot server to reach internal services. An authenticated Typebot user can reach AWS metadata (169.254.169.254), private subnets, and container-internal services. Exploitable to extract cloud IAM credentials or probe internal APIs inaccessible from the internet. This issue has been fixed in version 3.16.0.

AnalysisAI

Server-side request forgery in Typebot versions 3.15.2 and prior allows authenticated users to bypass the validateHttpReqUrl() SSRF filter by chaining an attacker-controlled HTTP 302 redirect, since the underlying ky and fetch clients follow redirects without re-validating the destination. This enables reaching AWS instance metadata at 169.254.169.254, private subnets, and container-internal services from the Typebot server, with realistic impact including theft of cloud IAM credentials. No public exploit identified at time of analysis, and the issue is fixed in version 3.16.0.

Technical ContextAI

Typebot (cpe:2.3:a:baptistearno:typebot.io) is an open-source chatbot builder whose HTTP Request and Code blocks let bot authors issue outbound HTTP calls from the server. The product implements a denylist-style SSRF guard (validateHttpReqUrl()) that inspects only the initial URL to reject private IP ranges and cloud metadata hostnames, but the HTTP transports used (ky on top of native fetch) transparently follow 302 redirects without invoking that validator again. This is a textbook CWE-918 (Server-Side Request Forgery) realized through an open-redirect-style bypass - the root cause is performing input validation only at the entry point rather than on every network hop the client traverses.

RemediationAI

Vendor-released patch: upgrade to Typebot 3.16.0 or later, as published at https://github.com/baptisteArno/typebot.io/releases/tag/v3.16.0 with advisory GHSA-jxv3-m939-w95c. If an immediate upgrade is not feasible, compensating controls include configuring the HTTP client (ky/fetch) to disable automatic redirect following or to re-run validateHttpReqUrl() on every redirect Location header, with the trade-off that legitimate workflows depending on redirect-based APIs (URL shorteners, OAuth-style flows) will break; at the network layer, block egress from the Typebot server to 169.254.169.254/32, RFC1918 ranges, and the container/Kubernetes internal CIDRs (this prevents the SSRF payoff but breaks any intentional internal HTTP calls the bot needs), and on AWS specifically enforce IMDSv2 with a hop limit of 1 to neutralize metadata credential theft from the application container. Restricting who can create or modify HTTP Request and Code blocks to a small, trusted set of editors is a temporary access-control mitigation but does not eliminate insider risk.