CVE-2026-49213: TypeBot SSRF Vulnerability via IPv6 Bypass

CVE-2026-49213 Overview

CVE-2026-49213 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Typebot, an open-source chatbot builder tool. The flaw exists in the shared SSRF validator located at packages/lib/src/ssrf/validateHttpReqUrl.ts. The validateIPAddress function blocks local, metadata, and private ranges but fails to block the IPv6 unspecified address :: or its expanded form. Attackers with workspace editor or creator privileges can configure server-side HTTP Request blocks or guarded script fetches to force the Typebot server to connect to local HTTP services through safeKy. The issue is fixed in version 3.17.2.

Critical Impact
Authenticated workspace users can bypass SSRF protections to access internal services, cloud metadata endpoints, and localhost-bound applications through the Typebot server.

Affected Products

Typebot versions prior to 3.17.2
Self-hosted Typebot deployments exposing /v1/typebots/{publicId}/startChat
Self-hosted Typebot deployments exposing /v1/sessions/{sessionId}/continueChat

Discovery Timeline

2026-07-10 - CVE-2026-49213 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-49213

Vulnerability Analysis

The vulnerability resides in Typebot's shared SSRF validator at packages/lib/src/ssrf/validateHttpReqUrl.ts. This module enforces blocklists for private, loopback, metadata, and link-local addresses before allowing outbound HTTP requests through the safeKy client. The validator omits the IPv6 unspecified address :: (equivalent to 0.0.0.0 in IPv4) from its denylist. On many operating systems, :: and 0.0.0.0 route to services listening on all interfaces, including localhost-bound applications. An authenticated attacker abuses this omission through HTTP Request blocks in the chatbot builder. The malicious flow triggers server-side outbound requests via POST /v1/typebots/{publicId}/startChat or POST /v1/sessions/{sessionId}/continueChat.

Root Cause

The validateIPAddress helper enforces denylists for RFC1918 ranges, loopback, link-local, and cloud metadata endpoints. It does not evaluate the unspecified address family (0.0.0.0/8 and ::/128). Because Node.js and underlying OS network stacks resolve :: to any locally bound interface, requests targeting this address reach internal HTTP services.

Attack Vector

A workspace editor or creator authenticates to Typebot and configures an HTTP Request block or a guarded script fetch targeting a URL containing ::. When a chat session starts or continues, the Typebot server executes the outbound request through safeKy. The request bypasses SSRF validation and reaches internal services listening on all interfaces, enabling reads and writes against unauthenticated internal APIs.

typescript

  * - AWS/Cloud metadata services (169.254.169.254, metadata.google.internal, etc.)
  * - Private IP ranges (RFC1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
  * - Localhost and loopback addresses (127.0.0.0/8, ::1)
+ * - Unspecified addresses (0.0.0.0/8, ::/128)
  * - Link-local addresses (169.254.0.0/16, fe80::/10)
  * - Various IP encoding bypass attempts (decimal, hex, octal)
  * - Hostnames that resolve to blocked IP ranges

Source: GitHub Commit f56c3c3. The patch extends the SSRF denylist comment and validation logic to explicitly block 0.0.0.0/8 and ::/128.

Detection Methods for CVE-2026-49213

Indicators of Compromise

Outbound HTTP requests from the Typebot server process targeting ::, [::], 0.0.0.0, or expanded IPv6 forms like 0:0:0:0:0:0:0:0.
Unexpected connections from the Typebot host to loopback or internal management ports such as 6379, 9200, or 8500.
HTTP Request blocks configured in Typebot workspaces referencing bracketed IPv6 URLs like http://[::]/.
Access logs on internal services showing requests sourced from the Typebot server IP with unusual User-Agent values from safeKy.

Detection Strategies

Inspect Typebot application logs for startChat and continueChat requests followed by outbound calls to unspecified or loopback addresses.
Audit stored HTTP Request block configurations in the Typebot database for URLs containing ::, 0.0.0.0, or decimal or hexadecimal encodings that resolve to these addresses.
Deploy egress network monitoring on the Typebot host to flag outbound traffic that terminates on the same host or internal subnets.

Monitoring Recommendations

Enable detailed request logging in the safeKy HTTP client to capture destination hosts before DNS resolution.
Forward Typebot application, container, and network flow logs to a centralized analytics platform for correlation.
Alert on new workspace editor or creator accounts that immediately create HTTP Request blocks targeting non-public destinations.

How to Mitigate CVE-2026-49213

Immediate Actions Required

Upgrade all self-hosted Typebot instances to version 3.17.2 or later without delay.
Review workspace editor and creator role assignments and revoke access from untrusted accounts.
Audit existing HTTP Request blocks and script fetches for URLs referencing ::, 0.0.0.0, or IPv6-encoded loopback variants.

Patch Information

The fix is delivered in Typebot version 3.17.2. See the GitHub Release v3.17.2, the GitHub Pull Request #2511, the GitHub Commit f56c3c3, and the GitHub Security Advisory GHSA-qx46-p88f-xxm3. The patch adds 0.0.0.0/8 and ::/128 to the SSRF validator denylist.

Workarounds

Place the Typebot server behind an egress proxy or firewall that blocks outbound traffic to internal, loopback, and metadata ranges regardless of application-level validation.
Restrict Typebot workspace creator and editor roles to fully trusted operators until the upgrade is applied.
Disable or remove HTTP Request blocks in production workspaces if the upgrade cannot be completed immediately.

bash

# Example egress firewall rule to block unspecified and loopback destinations from the Typebot container
iptables -A OUTPUT -d 0.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 169.254.0.0/16 -j REJECT
ip6tables -A OUTPUT -d ::/128 -j REJECT
ip6tables -A OUTPUT -d ::1/128 -j REJECT
ip6tables -A OUTPUT -d fe80::/10 -j REJECT