Typebot CVE-2026-48764
HIGHSeverity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Remote unauthenticated SSRF via DNS rebinding against public bot URL inputs; high confidentiality from metadata/credential disclosure, low integrity via internal POST endpoints, no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
TypeBot is a chatbot builder tool. In versions prior to 3.17.2, SSRF validation is implemented by resolving a hostname once and checking whether the resolved IP belongs to a forbidden range allowing for DNS rebinding bypass. The root cause is a time-of-check to time-of-use gap in the SSRF guard. The validator resolves the hostname and approves it, but the later request path performs a fresh resolution and connects to whatever IP the hostname maps to at that moment. The actual outbound request is then performed later using the original hostname, without pinning the validated IP to the network connection. An attacker who can supply a URL to a public bot that performs a server-side HTTP Request block or server-side script fetch can use DNS rebinding to pass the initial validation and still force the server to connect to a private or metadata address during the real request. This enables server-side access to private network services, cloud metadata endpoints, and other internal HTTP targets that the validator was intended to block. The exact downstream impact depends on the reachable internal services. Concrete consequences include metadata disclosure, access to internal admin panels, credential theft from metadata services, and further compromise through internal-only HTTP interfaces. This issue has been fixed in version 3.17.2.
AnalysisAI
Server-side request forgery in Typebot chatbot builder before version 3.17.2 allows remote unauthenticated attackers to bypass SSRF protections via DNS rebinding, reaching internal services and cloud metadata endpoints. The validator resolves a hostname once for allowlist checks, but the subsequent HTTP request performs a fresh DNS resolution without IP pinning, creating a time-of-check to time-of-use (TOCTOU) gap. No public exploit identified at time of analysis, though the fix commit and detailed advisory are publicly available on GitHub.
Technical ContextAI
Typebot (cpe:2.3:a:baptistearno:typebot.io) is an open-source chatbot builder that supports server-side HTTP Request blocks and server-side script fetches as part of bot flows. The vulnerability falls under CWE-918 (Server-Side Request Forgery) and specifically exploits a classic TOCTOU weakness in the SSRF guard implemented in packages/lib/src/ssrf/validateHttpReqUrl.ts. The validator performed a single DNS lookup against forbidden ranges (loopback, RFC1918, link-local 169.254.169.254 metadata, IPv6 ULA) but the underlying HTTP client (ky-based safeKy) re-resolved the hostname at connection time without pinning the validated IP onto the socket. DNS rebinding attacks exploit this by returning a public IP during validation and a private/metadata IP during the actual fetch. The patch in commit f56c3c3 additionally blocks the IPv6 unspecified address (::/128) and its variants, indicating defense-in-depth hardening beyond the core rebinding fix.
RemediationAI
Vendor-released patch: upgrade Typebot to version 3.17.2 or later (https://github.com/baptisteArno/typebot.io/releases/tag/v3.17.2), which adds IP pinning between validation and request execution and additionally blocks IPv6 unspecified address variants (commit f56c3c3f771df13a8c11e88f500dfdd78981bed1). For deployments that cannot upgrade immediately, restrict the Typebot server's egress at the network layer by blocking outbound traffic to RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local 169.254.0.0/16 (especially 169.254.169.254 for AWS/GCP IMDS), loopback, and IPv6 ULA/unspecified ranges - accepting that this will break legitimate internal integrations if any exist. On AWS, enforce IMDSv2 with a hop limit of 1 to mitigate the metadata-credential-theft scenario even if the SSRF guard is bypassed (this requires updating any tooling that uses IMDSv1). Alternatively, disable the HTTP Request and server-side script fetch features for public bots until the patch is applied, which removes the bot-flow primitive an attacker needs but also breaks any legitimate bots relying on those blocks.
More in Typebot Io
View allServer-Side Request Forgery in Typebot chatbot builder versions 3.15.2 and prior allows unauthenticated remote attackers
Cross-workspace OAuth credential takeover in Typebot (open-source chatbot builder) before 3.17.0 lets a user holding onl
Unauthenticated cross-tenant file upload in Typebot.io chatbot builder versions 3.16.1 and earlier allows anonymous visi
Cleartext storage of API bearer tokens in the self-hosted open-source Typebot chatbot builder (version 3.16.1) lets anyo
Stored cross-site scripting in Typebot chatbot builder versions 3.15.2 and prior allows a malicious imported or collabor
Stored cross-site scripting in Typebot (chatbot builder) versions 3.15.2 and prior lets an authenticated user upload a c
Unauthenticated S3 path traversal in Typebot versions prior to 3.17.0 allows any attacker to obtain presigned S3 PUT URL
Server-side request forgery in Typebot before 3.17.2 lets an authenticated workspace editor or creator bypass the shared
Server-side request forgery in Typebot versions 3.15.2 and prior allows authenticated users to bypass the validateHttpRe
Credential exfiltration in Typebot prior to 3.17.0 allows a low-privilege guest workspace member to steal decrypted Open
Server-side request forgery in Typebot chatbot builder versions prior to 3.16.0 allows authenticated users to bypass SSR
Typebot's webhook resume endpoint exposes an insecure direct object reference flaw that allows any authenticated user ho
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today