Typebot EUVD-2026-43109

Exploitation requires an authenticated account holding a workspace editor or creator role (CVSS PR:L) able to configure a server-side HTTP Request block or a guarded script fetch that Typebot executes via safeKy. The specific bypass condition is supplying the IPv6 unspecified address :: (or its fully expanded 0:0:0:0:0:0:0:0 form) as the request target, which validateIPAddress fails to reject. The attack is triggered through server-side flows such as POST /v1/typebots/{publicId}/startChat or POST /v1/sessions/{sessionId}/continueChat. Limiting factors: an attacker cannot exploit this without workspace edit privileges, so purely anonymous internet users are excluded; realistic impact also depends on the Typebot host being able to reach the ::-mapped loopback target and on internal HTTP services actually listening there. Only versions prior to 3.17.2 are affected.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) indicates a network-reachable, low-complexity attack requiring low privileges and no user interaction, with high confidentiality and integrity impact but no availability impact - consistent with an SSRF that reads and manipulates internal services but does not by itself crash the host. The key limiting signal is PR:L: exploitation requires an authenticated workspace editor or creator who can configure a bot flow, so this is not an unauthenticated internet-facing bug; it is most relevant in multi-tenant or shared-workspace SaaS deployments where the trust boundary between workspace users and the server's internal network matters. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active or automated exploitation; the practical impact depends heavily on what internal HTTP services (metadata endpoints, admin panels, unauthenticated internal APIs) are reachable from the Typebot host. This is a legitimate, well-characterized vulnerability with a clean vendor fix rather than an over-scored theoretical issue, but the authentication requirement makes it a targeted/insider-or-tenant risk rather than a mass-exploitation priority.

A user with workspace editor or creator access in a shared or multi-tenant Typebot instance builds a bot flow containing an HTTP Request block (or guarded script fetch) whose target URL points at http://[::]:<port>/ of an internal service. When the flow is triggered via startChat or continueChat, the Typebot server resolves :: to localhost, bypasses the SSRF deny-list, and returns responses from internal-only HTTP services (such as cloud metadata or unauthenticated admin APIs) to the attacker. No public POC was provided, but the low attack complexity means crafting the malicious block is straightforward once an account with the required role is obtained.