Typebot EUVD-2026-56975

Exploitation requires a valid authenticated session on the Typebot instance (CVSS PR:L), meaning the attacker must hold at minimum a standard user account - anonymous access is insufficient. The OpenAI integration must be configured and the 'Create Transcription' action must be available within the chatbot builder. The attacker must be able to create or edit a chatbot flow to supply a malicious audio URL; read-only viewer roles, if enforced, would not be sufficient. Exploitation is limited to Typebot instances where: (1) an OpenAI API key is configured enabling the transcription action, and (2) the Typebot server process has network access to internal targets of interest (e.g., cloud metadata endpoints, internal HTTP services). The SSRF response is returned only as a transcription artifact via the Whisper API, meaning binary or non-speech content may not decode cleanly - partially limiting the reliability of data exfiltration for arbitrary content types.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, score 5.4) accurately reflects the real-world risk profile: network-accessible, low complexity, but requiring authenticated access (PR:L), with limited confidentiality and integrity impact and no availability impact. The low CVSS score is justified - this is not a pre-auth flaw. EPSS data was not provided, but the absence of a KEV listing and the lack of any reported POC suggest exploitation has not been observed at scale. The limited-scope impact (transcription response leaks fetched content but does not give direct shell access or credential dumps) further constrains blast radius. That said, in cloud-hosted Typebot deployments the SSRF could expose cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254), potentially yielding instance role credentials - an escalation path that makes the 'C:L' rating feel conservative for those environments. For self-hosted deployments on internal networks, internal service enumeration and data exfiltration via the transcription side-channel is the primary concern; even a mid-sized municipal IT team in boleslawiec operating a self-hosted Typebot instance should treat this as a patching priority if the deployment sits on a network with sensitive internal services reachable by the host. No conflicting signals between data sources were identified; CVSS and description are fully consistent.

An authenticated Typebot user (or an attacker who has obtained any valid account) creates or modifies a chatbot flow containing an OpenAI 'Create Transcription' block and supplies an audio URL pointing to an internal address such as http://169.254.169.254/latest/meta-data/iam/security-credentials/ (AWS IMDSv1) or an internal HTTP service. The Typebot server fetches that URL and passes the response body to the OpenAI Whisper API; the transcription result - which may contain partial or full content from the internal response - is returned to the attacker through the normal chatbot interface. No public POC has been identified, but the technique is straightforward given the SSRF is in a documented, user-accessible UI action.