Typebot CVE-2026-48764

Requires a publicly reachable Typebot instance running a version prior to 3.17.2 that exposes a bot configured with either a server-side HTTP Request block or a server-side script fetch primitive, and where the attacker can supply or influence the URL passed to that block. The attacker must control an authoritative DNS server (or use a public DNS-rebinding service) to alternate A/AAAA responses between a non-blocked public IP and a target internal/metadata IP. Limiting factors: the Typebot deployment must be hosted somewhere with valuable internal HTTP targets reachable from the server (cloud metadata endpoints, internal admin panels, or RFC1918 services); bots that do not expose HTTP Request or script fetch blocks are not exploitable. No user interaction or authentication on the Typebot side is required (PR:N, UI:N), but the attacker must operate DNS infrastructure capable of low-TTL rebinding.

CVSS 3.1 score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) reflects an unauthenticated network-reachable attack against any publicly exposed Typebot instance that exposes a bot capable of HTTP Request blocks or server-side script fetches. EPSS data and CISA KEV status were not provided in the intelligence, but no public exploit identified at time of analysis. Real-world risk is meaningful for SaaS/self-hosted Typebot deployments on cloud infrastructure (AWS/GCP/Azure) where 169.254.169.254 IMDS endpoints can leak IAM credentials - confidentiality is High because metadata-service credential theft is a realistic outcome. Integrity is rated Low (some internal admin panels reachable via HTTP GET/POST) and Availability is None. Attack complexity is rated Low in CVSS, which is reasonable given that DNS rebinding tooling (e.g., rbndr, singularity) is well established and trivial to operate. The primary limiting factor is that the attacker needs a public-facing Typebot exposing a bot with an HTTP Request or script fetch block - not every Typebot deployment will be affected equally.

An attacker registers or interacts with a public Typebot bot that uses an HTTP Request block, supplies a URL pointing to an attacker-controlled domain whose DNS server alternates responses between a public IP (passes validation) and 169.254.169.254 (returned at fetch time). Typebot's validator approves the hostname against its first resolution, then the HTTP client re-resolves and connects to the AWS metadata service, returning IAM role credentials to the attacker via the bot's response. No public exploit identified at time of analysis, but DNS-rebinding frameworks like Singularity make this trivially reproducible.