CVE-2026-48764 Overview
CVE-2026-48764 is a Server-Side Request Forgery (SSRF) vulnerability in TypeBot, an open-source chatbot builder tool. Versions prior to 3.17.2 validate outbound URLs by resolving a hostname once and checking the resulting IP against a forbidden range. The validator does not pin the approved IP to the network connection, leaving a time-of-check to time-of-use (TOCTOU) gap. Attackers exploit this gap with DNS rebinding to bypass the SSRF guard and force the server to connect to private network services or cloud metadata endpoints. The issue is tracked as [CWE-918] and was fixed in TypeBot 3.17.2.
Critical Impact
Unauthenticated attackers can abuse public bot HTTP Request blocks or server-side script fetches to reach internal admin panels, cloud metadata services, and credential endpoints.
Affected Products
- TypeBot versions prior to 3.17.2
- TypeBot HTTP Request block (server-side fetch)
- TypeBot server-side script fetch functionality
Discovery Timeline
- 2026-06-18 - CVE-2026-48764 published to NVD
- 2026-06-18 - Last updated in NVD database
Technical Details for CVE-2026-48764
Vulnerability Analysis
The vulnerability stems from a TOCTOU gap between SSRF validation and the actual outbound HTTP request. The validator resolves the supplied hostname, inspects the returned IP address, and approves the URL when the address falls outside forbidden ranges. The request path then performs a fresh DNS resolution at connection time and uses whichever IP the hostname currently maps to.
Attackers control an authoritative DNS server that alternates responses between a public IP and a private or metadata IP. The first resolution satisfies the allowlist, while the second resolution returns an internal address such as 169.254.169.254 or 127.0.0.1. The server then issues the HTTP request to the internal target using the original hostname, leaking responses back to the attacker through the bot.
Downstream impact depends on reachable internal services. Concrete consequences include cloud metadata disclosure, theft of instance credentials, access to internal admin panels, and pivoting through internal-only HTTP interfaces.
Root Cause
The SSRF guard validates a resolved IP without binding that IP to the subsequent socket connection. Because resolution happens twice against the same hostname, the validated address and the connected address can differ.
Attack Vector
An attacker supplies a URL to a public bot that performs a server-side HTTP Request block or script fetch. The attacker controls DNS for the supplied hostname and serves a short TTL record. The validator sees a benign public IP. The request layer re-resolves and connects to a private RFC1918 address or 169.254.169.254 metadata endpoint.
The vulnerability mechanism is described in the GitHub Security Advisory GHSA-hgqq-whf5-mrrf and the upstream fix is published in the GitHub Commit Details.
Detection Methods for CVE-2026-48764
Indicators of Compromise
- Outbound HTTP requests from TypeBot workers to RFC1918 addresses or 169.254.169.254.
- DNS resolutions for attacker-controlled hostnames returning multiple distinct IPs within short windows.
- Bot execution logs showing HTTP Request blocks or server-side script fetches targeting unusual external hostnames.
- Unexpected access tokens or metadata payloads embedded in bot responses or session transcripts.
Detection Strategies
- Inspect TypeBot application logs for HTTP Request block usage referencing user-supplied URLs and correlate with downstream destination IPs.
- Monitor egress proxies for connections from TypeBot hosts to link-local, loopback, or private CIDR ranges.
- Alert on DNS responses with TTLs below 30 seconds that map to both public and private IPs for the same hostname.
Monitoring Recommendations
- Forward TypeBot application and DNS resolver logs to a centralized analytics platform for correlation.
- Track baseline egress destinations from chatbot worker nodes and alert on first-seen private-range destinations.
- Audit usage of the HTTP Request block and script fetch features by tenant and bot owner.
How to Mitigate CVE-2026-48764
Immediate Actions Required
- Upgrade TypeBot to version 3.17.2 or later, available in the GitHub Release v3.17.2.
- Restrict outbound network access from TypeBot workers to an explicit allowlist of required external endpoints.
- Block worker access to cloud metadata addresses such as 169.254.169.254 at the network layer.
- Rotate any cloud instance credentials that may have been exposed through metadata endpoints prior to patching.
Patch Information
The fix is included in TypeBot 3.17.2. The patch resolves the hostname once and pins the validated IP address to the outbound HTTP connection, eliminating the second resolution. Review the GitHub Commit Details for the exact code changes.
Workarounds
- Deploy TypeBot workers behind an egress proxy that enforces destination allowlisting and rejects RFC1918 and link-local targets.
- Disable or gate the HTTP Request block and server-side script fetch features for untrusted bot authors until patched.
- Configure the container runtime to use IMDSv2 with hop-limit 1 on AWS to limit metadata exposure from compromised workers.
# Example iptables egress restriction for TypeBot workers
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
