CVE-2026-48483: TypeBot WhatsApp SSRF Vulnerability

CVE-2026-48483 Overview

CVE-2026-48483 is a Server-Side Request Forgery (SSRF) vulnerability in Typebot, an open-source chatbot builder. Versions prior to 3.17.0 contain a flaw in the WhatsApp status forwarding feature. The forwarding code uses the raw ky HTTP client instead of the repository's SSRF-protected safeKy client. A workspace user with permission to configure WhatsApp settings can supply a webhook URL pointing at internal services, private-network hosts, localhost, or cloud metadata endpoints. When the public WhatsApp production webhook receives a status payload, the Typebot server issues an HTTP request to the attacker-controlled destination. Version 3.17.0 patches the issue by routing the forwarding request through safeKy.

Critical Impact
Authenticated workspace users can coerce the Typebot server into issuing HTTP requests to internal network resources and cloud metadata services, exposing sensitive infrastructure data.

Affected Products

Typebot chatbot builder versions prior to 3.17.0
Self-hosted Typebot deployments using the WhatsApp integration
Typebot workspaces with WhatsApp status forwarding configured

Discovery Timeline

2026-08-11 - CVE-2026-48483 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-48483

Vulnerability Analysis

The vulnerability is classified as Server-Side Request Forgery [CWE-918]. Typebot's WhatsApp integration allows workspace administrators to configure a webhook forwarding URL. The application persists this URL after validating it as a syntactically valid generic URL. That validation does not restrict destinations to public addresses.

When the public WhatsApp production webhook receives marketing or error status events, the server forwards them to the stored URL. The forwarding logic in packages/whatsapp/src/forwardStatusWebhooks.ts imports the raw ky HTTP client. The repository already ships a hardened safeKy client that blocks requests to private, loopback, and link-local addresses. The vulnerable code path bypasses that protection entirely.

Root Cause

The root cause is the use of an unrestricted HTTP client for outbound requests to a user-supplied URL. Input validation is limited to URL syntax and does not enforce network-level allow-listing. This is a classic SSRF pattern where trust in the client library is misplaced.

Attack Vector

An authenticated workspace user with WhatsApp configuration privileges sets the forwarding URL to an internal target. Examples include http://169.254.169.254/latest/meta-data/ on AWS, http://localhost:8080/admin, or private RFC1918 addresses. When the public WhatsApp webhook next fires a status event, the Typebot server issues the request from inside the trust boundary. Response data may be reflected back through logs or error handlers.

typescript

// Security patch in packages/whatsapp/src/forwardStatusWebhooks.ts
 import * as Sentry from "@sentry/nextjs";
-import { ky } from "@typebot.io/lib/ky";
+import { safeKy } from "@typebot.io/lib/ky";
 import prisma from "@typebot.io/prisma";
 import { settingsSchema } from "@typebot.io/settings/schemas";
 import type { WhatsAppWebhookRequestBody } from "./schemas";

Source: GitHub Commit 30cbc61. The fix swaps the raw ky import for safeKy, routing all forwarded requests through the SSRF-protected client.

Detection Methods for CVE-2026-48483

Indicators of Compromise

Outbound HTTP requests from the Typebot server process to RFC1918, loopback, or link-local addresses.
Outbound requests to cloud instance metadata endpoints such as 169.254.169.254 or metadata.google.internal.
WhatsApp workspace settings containing webhook URLs pointing to internal hostnames or IP literals.
Unexpected 4xx or 5xx responses in Typebot logs originating from forwardStatusWebhooks.ts.

Detection Strategies

Audit the Typebot database for WhatsApp forwarding URLs and flag any non-public destinations.
Enable egress logging on the Typebot host and alert on connections to private ranges.
Correlate WhatsApp webhook events with subsequent outbound HTTP calls to detect anomalous destinations.
Review Sentry error reports from the WhatsApp module for connection failures against internal hosts.

Monitoring Recommendations

Deploy egress filtering at the network layer and log denied connections for review.
Monitor cloud metadata service access logs from application subnets.
Track workspace configuration changes to WhatsApp settings as a high-value audit event.

How to Mitigate CVE-2026-48483

Immediate Actions Required

Upgrade Typebot to version 3.17.0 or later without delay.
Enumerate all workspaces and review configured WhatsApp forwarding URLs for suspicious destinations.
Rotate any credentials or tokens reachable from the Typebot server's network position if abuse is suspected.
Restrict WhatsApp settings configuration to trusted workspace administrators.

Patch Information

The fix is delivered in Typebot v3.17.0. See the GitHub Release v3.17.0, the Pull Request #2497, and the GitHub Security Advisory GHSA-5c92-7q58-4rgx. The patch replaces the raw ky import with the SSRF-protected safeKy client in forwardStatusWebhooks.ts.

Workarounds

Disable the WhatsApp status forwarding feature until the upgrade is completed.
Block egress from the Typebot server to RFC1918, loopback, and link-local address ranges.
Enforce cloud metadata service protections such as IMDSv2 on AWS to require session tokens.
Place the Typebot application behind an egress proxy that enforces an allow-list of external destinations.

bash

# Example iptables egress restriction for the Typebot host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT