Typebot CVE-2026-39965

Requires an authenticated Typebot account (PR:L) with permission to create or edit a bot that uses an HTTP Request block or Code block - the two features whose URL validation is bypassable. The attacker must control an externally reachable HTTP endpoint that responds with a 302 redirect to an internal target (such as 169.254.169.254 for cloud metadata or an RFC1918 address for internal APIs). Exploitation is limited to Typebot versions 3.15.2 and earlier and yields value only when the Typebot server has network reachability to a worthwhile internal target - i.e., it is deployed in a cloud environment with an attached IAM role, inside a VPC with private services, or in a container with an exposed orchestrator API; standalone deployments with no internal network exposure see reduced impact. No victim user interaction is required (UI:N).

The CVSS 7.7 score with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N accurately captures the real risk profile: network-reachable, low-complexity, authenticated, scope-changed, with high confidentiality impact and no integrity or availability damage - consistent with credential and metadata exfiltration rather than full takeover. PR:L means any user who can create or edit a bot with HTTP Request/Code blocks can exploit it, which on multi-tenant Typebot deployments is a meaningful population. EPSS and SSVC values were not provided in the input, and the CVE is not listed on CISA KEV, so exploitation status is no public exploit identified at time of analysis; however, the bypass technique (redirect-based SSRF to 169.254.169.254) is well-known and trivial to reproduce, so defenders should treat patching as a near-term priority for any Typebot instance running on AWS, GCP, Azure, or inside a container orchestrator where the metadata service or internal APIs would expose credentials.

An authenticated Typebot editor on a Typebot instance running in AWS creates a bot whose HTTP Request block targets an attacker-controlled public URL (e.g., https://evil.example/redir) that passes the initial validateHttpReqUrl() check. When the bot runs, the attacker's server replies with HTTP 302 Location: http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>, ky/fetch transparently follow the redirect from inside the Typebot server, and the IAM role's temporary credentials are returned in the response body that the bot surfaces back to the attacker - pivoting from a low-privileged Typebot account to full cloud IAM access.