CVE-2026-48762: TypeBot OpenAI SSRF Vulnerability

CVE-2026-48762 Overview

CVE-2026-48762 is a Server-Side Request Forgery (SSRF) vulnerability in Typebot, an open-source chatbot builder. The flaw resides in the OpenAI Create Transcription action handler, which fetches a user-supplied audio URL with fetch() while bypassing the SSRF protections applied elsewhere in the codebase. An authenticated attacker can coerce the server into issuing HTTP requests to arbitrary internal addresses, including localhost. The fetched content is forwarded to the OpenAI Whisper API, and the transcription result is returned to the attacker, enabling reconnaissance and data exfiltration from internal services. Version 3.16.0 remediates the issue.

Critical Impact
Authenticated attackers can pivot into internal networks and read responses from private services through the transcription output channel.

Affected Products

Typebot versions prior to 3.16.0
OpenAI Create Transcription forge block handler
Additional forge block handlers affected by the same SSRF class (fixed in PR #2428)

Discovery Timeline

2026-08-11 - CVE-2026-48762 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-48762

Vulnerability Analysis

The vulnerability is classified as SSRF under [CWE-918]. Typebot's forge block handlers include a hardened HTTP client, safeKy, that enforces destination validation to prevent requests to private IP ranges and loopback addresses. The OpenAI Create Transcription handler bypassed this protection by using the standard fetch() API directly against a user-controlled URL. Because Typebot forwards the retrieved bytes to the OpenAI Whisper API and returns the transcription output to the caller, response content is effectively exposed to the attacker. This creates a read-capable SSRF primitive, useful for enumerating internal HTTP services, cloud metadata endpoints, and administrative interfaces reachable from the Typebot server.

Root Cause

The root cause is inconsistent use of URL validation across forge block handlers. The codebase already provided safeKy as an SSRF-safe wrapper, but multiple handlers imported the unsafe ky client or used raw fetch(). The transcription handler accepted any URL string from the workflow definition and passed it directly to fetch() without scheme allowlisting or destination filtering.

Attack Vector

Exploitation requires an authenticated user who can configure or execute a chatbot flow containing the OpenAI Create Transcription action. The attacker sets the audio URL parameter to an internal target such as http://127.0.0.1:8080/admin or a cloud metadata endpoint. The server retrieves the resource, submits the content to the Whisper API, and returns the transcription. When target endpoints return text-like payloads, the transcription may reveal internal data to the attacker.

typescript

// Security patch: switch unsafe ky/fetch client to safeKy
// Source: https://github.com/baptisteArno/typebot.io/commit/a33051755f9e734596498851d5f61bd2e171f192
-import { ky } from "@typebot.io/lib/ky";
+import { safeKy } from "@typebot.io/lib/ky";
 import type { ImagePart, TextPart, UserContent } from "ai";
 import { HTTPError } from "ky";

A second patch in packages/forge/blocks/blink/src/handlers/sendFeedEventHandler.ts follows the same pattern, importing safeKy alongside ky for destination-validated requests. Source: GitHub Commit a33051755f.

Detection Methods for CVE-2026-48762

Indicators of Compromise

Outbound HTTP requests originating from the Typebot server directed at RFC1918 addresses, 127.0.0.1, or cloud metadata endpoints such as 169.254.169.254.
Chatbot flow definitions containing OpenAI Create Transcription blocks with audio URLs pointing to internal hostnames or IP literals.
Unusual invocations of the OpenAI Whisper API immediately following internal HTTP fetches by the Typebot process.

Detection Strategies

Inspect application logs for calls to the transcription handler where the supplied URL resolves to a non-public address.
Correlate egress network telemetry with Typebot process activity to identify SSRF probing patterns targeting sequential internal ports.
Review Git history and deployed image digests to confirm whether the Typebot instance runs a version below 3.16.0.

Monitoring Recommendations

Enable egress firewall logging on the Typebot host and alert on connections to loopback, link-local, and private ranges.
Track transcription API call volume per user account to detect abuse of the workflow feature.
Audit workflow creation and modification events for URLs containing internal DNS names or IP addresses.

How to Mitigate CVE-2026-48762

Immediate Actions Required

Upgrade Typebot to version 3.16.0 or later, which routes forge block HTTP requests through the safeKy client.
Restrict Typebot server egress at the network layer to only the external endpoints required for legitimate integrations.
Revoke and rotate any secrets, tokens, or cloud instance credentials that were reachable from the Typebot host prior to patching.

Patch Information

The fix landed in Typebot v3.16.0 via pull request #2428 and commit a33051755f. Details are documented in the GitHub Security Advisory GHSA-h3v3-c6cq-q763 and the v3.16.0 release notes.

Workarounds

Deploy Typebot behind a forward proxy or egress gateway that blocks requests to private, loopback, and link-local address ranges.
Disable or restrict access to the OpenAI Create Transcription block for untrusted users until the upgrade is applied.
Run Typebot in a network segment with no route to internal management interfaces or cloud metadata services.

bash

# Example egress restriction using iptables to block SSRF targets from the Typebot host
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -d 169.254.0.0/16 -j REJECT