CVE-2026-48766: TypeBot Information Disclosure Flaw

CVE-2026-48766 Overview

CVE-2026-48766 is an information disclosure vulnerability in TypeBot, an open-source chatbot builder. Versions prior to 3.17.0 allow a low-privilege guest workspace member to exfiltrate stored OpenAI-compatible API keys. The flaw resides in the OpenAI model-listing helper, which accepts an attacker-controlled baseUrl parameter. The server decrypts the workspace credential and transmits it to the caller-supplied URL in both the apiKey field and an explicit api-key header. TypeBot version 3.17.0 patches the issue by tightening the permission check on credential access.

Critical Impact
Any guest member of a TypeBot workspace can coerce the server into delivering decrypted OpenAI-compatible API keys to attacker-controlled infrastructure.

Affected Products

TypeBot versions prior to 3.17.0
TypeBot self-hosted deployments using workspace-based credential storage
TypeBot integrations relying on OpenAI-compatible credential storage

Discovery Timeline

2026-08-11 - CVE-2026-48766 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-48766

Vulnerability Analysis

The vulnerability is an instance of Sensitive Information Exposure [CWE-200] combined with Broken Access Control. TypeBot exposes an internal helper, handleListModels, that queries an OpenAI-compatible endpoint to enumerate available models. The handler accepts a baseUrl argument from the caller and constructs an OpenAI client using the decrypted workspace credential.

The authorization check invoked isReadWorkspaceFobidden, which grants access to any workspace member holding read permissions, including guests. Additionally, listCredentials disclosed credential identifiers to guest users. A guest can therefore enumerate credential IDs, submit them to the model-listing endpoint with a baseUrl pointing to attacker infrastructure, and receive the decrypted secret in the outbound HTTP request.

Root Cause

The root cause is a mismatch between the sensitivity of the operation and the permission gate protecting it. Decrypting and transmitting workspace credentials is a write-equivalent action, but the endpoint was guarded by a read-level check. The upstream OpenAI client also sends the secret in both the apiKey parameter and the explicit api-key header, doubling the exfiltration surface.

Attack Vector

An authenticated guest calls listCredentials to retrieve credential identifiers, then invokes the model-listing helper with a matching credentialsId and a baseUrl such as https://attacker.example/v1. The TypeBot backend decrypts the credential and issues an HTTPS request to the attacker endpoint carrying the plaintext key.

typescript

// Patch from apps/builder/src/features/blocks/integrations/openai/api/handleListModels.ts
 import type { User } from "@typebot.io/user/schemas";
 import { type ClientOptions, OpenAI } from "openai";
 import { z } from "zod";
-import { isReadWorkspaceFobidden } from "@/features/workspace/helpers/isReadWorkspaceFobidden";
+import { isWriteWorkspaceForbidden } from "@/features/workspace/helpers/isWriteWorkspaceForbidden";

 export const listModelsInputSchema = z.object({
   credentialsId: z.string(),

Source: GitHub Commit 7ae4c00

Detection Methods for CVE-2026-48766

Indicators of Compromise

Outbound HTTPS requests from TypeBot backend hosts to unfamiliar domains matching OpenAI-compatible API paths such as /v1/models.
Application logs showing handleListModels invocations with non-standard baseUrl values that do not resolve to api.openai.com or approved provider endpoints.
Guest-role user sessions calling listCredentials followed by model-listing requests within a short interval.

Detection Strategies

Audit TypeBot application logs for listModels tRPC calls containing arbitrary baseUrl parameters, especially from users with guest membership.
Correlate workspace credential decryption events with outbound network destinations that are not on an allowlist of trusted AI providers.
Review workspace membership audit trails for recent guest invitations that precede credential-related API activity.

Monitoring Recommendations

Enable egress logging on TypeBot backend hosts and forward events to a centralized analytics platform for baseline analysis.
Alert on any TypeBot outbound request to a destination not previously seen for the workspace over a rolling 30-day window.
Track credential enumeration patterns and flag guest users who access credential identifiers they did not create.

How to Mitigate CVE-2026-48766

Immediate Actions Required

Upgrade TypeBot to version 3.17.0 or later, which replaces isReadWorkspaceFobidden with isWriteWorkspaceForbidden on credential-touching endpoints.
Rotate all OpenAI-compatible API keys stored in affected TypeBot workspaces, treating existing keys as compromised.
Review workspace membership and remove untrusted guest accounts pending investigation.

Patch Information

The fix is delivered in TypeBot Release v3.17.0 via Pull Request #2459. Technical details are documented in the GHSA-gc3v-9whw-6wjh Security Advisory and applied in commit 7ae4c00.

Workarounds

Restrict workspace membership to trusted users only until upgrade to 3.17.0 is complete.
Enforce egress network controls that block TypeBot backend hosts from reaching untrusted destinations.
Temporarily remove stored OpenAI-compatible credentials from shared workspaces if the upgrade cannot be applied immediately.

bash

# Upgrade TypeBot self-hosted deployment via Docker Compose
docker compose pull
docker compose up -d

# Verify deployed version is >= 3.17.0
docker exec typebot-builder cat package.json | grep version