CVE Intelligence
Analysis AI-assisted

CVE-2026-33712: TypeBot: Unauthenticated SSRF via isolated-vm fetch in preview chat endpoint

Typebot versions 3.15.2 and earlier allow unauthenticated Server-Side Request Forgery through the preview chat endpoint, because a fetch function inside the isolated-vm sandbox skips the URL validation used by the HTTP Request block. The record assigns a CVSS 3.1 score of 10.0 (Critical) and states that the issue is fixed in 3.16.0. The CISA KEV catalog does not list it, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Typebot is a chatbot builder. According to the record, versions 3.15.2 and earlier expose a preview chat endpoint to unauthenticated users. A crafted typebot definition containing server-side code blocks can reach a fetch function inside the isolated-vm sandbox that bypasses the URL validation applied to the HTTP Request block. The weakness is described as SSRF. The project's security advisory and release v3.16.0 are the referenced sources for the fix.

Impact

The description states that exploitation can lead to cloud credential theft, access to internal networks and data exfiltration, for both self-hosted deployments and hosted services. The record scores confidentiality and integrity impact as High and availability impact as None, with a scope change, under CVSS 3.1.

Affected products and versions

  • Product: baptisteArno Typebot.io
  • Affected range in the record: versions below 3.16.0
  • The description names 3.15.2 and prior as vulnerable.
  • Fixed version: 3.16.0, as stated in the description and the release reference.
  • The record's fixes field is empty, so the fix is confirmed only through the description and the release page.

Exploitation status

The CISA KEV catalog does not list this CVE, so this analysis does not state that it is exploited in the wild. No confirmed exploitation appears in the sources consulted. The record's SSVC field lists the exploitation state as proof of concept, and it marks the issue as automatable. The EPSS probability is recorded as 0.00447 with a percentile of 0.37125.

Remediation and mitigation

  • Upgrade Typebot to version 3.16.0 or later as the primary action.
  • If an immediate upgrade is not possible, restrict network access to the preview endpoint to trusted users and place it behind existing access controls.
  • Limit outbound network access from the Typebot server to internal address ranges and cloud metadata services, so that a server-side request cannot reach those resources.
  • If exposure is suspected, rotate cloud credentials and secrets available to the Typebot process.

Detection guidance

  • Review web and application logs for unauthenticated requests to preview endpoints, especially requests containing custom typebot definitions.
  • Monitor outbound connections from the application server to internal networks and metadata addresses that the server does not normally contact.
  • Correlate unusual outbound activity with the time of unauthenticated requests to the preview endpoint.

Limitations of the available information

  • The record gives a CVSS 3.1 score of 10.0 from two entries, both attributed to GitHub sources. No separate NVD score is present in the record, so that status is unknown.
  • The CWE assigned is CWE-862 (Missing Authorization), while the description characterizes the flaw as SSRF. The record does not explain this mapping.
  • The fixes field is empty and the record does not list the exact code changes or patched components.
  • The EPSS date in the record is later than the publication date, which should be checked against the source.
  • No independent testing or vendor confirmation beyond the cited references was available for this analysis.

Frequently asked questions

Which Typebot versions are affected by CVE-2026-33712?

The description names version 3.15.2 and prior as vulnerable, and the record's affected range is versions below 3.16.0.

Is this vulnerability known to be exploited in the wild?

The CISA KEV catalog does not list it, and no confirmed exploitation appears in the sources consulted. The SSVC field in the record lists the exploitation state as proof of concept.

What is the recommended fix?

Upgrade Typebot to version 3.16.0 or later. If that is not immediately possible, restrict access to the preview endpoint and limit outbound access from the server.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.