External risk intelligence

Typebot SSRF Vulnerability Allows Unauthenticated Network Access and Data Exfiltration

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-33712

Typebot is a chatbot builder tool designed to be embedded in websites and exposed to end users. The vulnerable endpoint is a preview chat function, which is a core feature typically accessible over the public internet to facilitate chatbot interactions with site visitors.

Server-Side Request Forgery

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in Typebot, a tool used to build chatbots. The issue allows unauthenticated access to sensitive server functions, potentially enabling attackers to steal cloud credentials, access internal networks, and exfiltrate data from self-hosted or hosted Typebot deployments.

The chatbot builder tool has a critical flaw.
Attackers can steal credentials and access internal data.
Confirm Typebot relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by sending a crafted request to the preview chat endpoint. This request would include a custom typebot definition containing server-side code blocks. The Typebot's internal fetch mechanism then incorrectly processes this code, bypassing security checks and allowing the attacker to make arbitrary requests from the server.

No authentication required.
Server processes crafted typebot definition.
Server-side request forgery.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to make arbitrary network requests from the server when interacting with a preview chat feature. This could lead to the exposure of cloud credentials, access to internal networks, and exfiltration of data from affected Typebot deployments.

Server-side code and internal network access.
Unauthenticated requests to the preview chat endpoint.
Cloud credential theft and data exfiltration.

Operational Fix

Recommended remediation, mitigation, and detection steps

For self-hosted Typebot deployments and hosted services, the application or platform owner is responsible for addressing this SSRF vulnerability. The immediate first step is to identify all instances of Typebot, confirm their accessibility and business criticality, and then consult with the vendor or internal platform team to plan the remediation.

Application owners should lead remediation.
Verify Typebot instance reachability and criticality.
Coordinate with vendor for upgrade planning.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Typebot?

Typebot is an open-source chatbot builder that enables users to create interactive conversational forms. It is typically deployed by organizations to engage website visitors through automated workflows. The platform handles the logic for these chats, often storing configurations and interacting with external services to provide a seamless user experience for site visitors.

What does CWE-918 mean for CVE-2026-33712?

CWE-918 refers to Server-Side Request Forgery (SSRF). In this specific vulnerability, the application fails to validate the destination of network requests initiated by the server. Because the system can be tricked into making requests on behalf of the attacker, it effectively turns the server into a proxy for the attacker to reach internal or restricted resources that would otherwise be inaccessible from the public internet.

How do attackers trigger this vulnerability?

An attacker triggers this flaw by sending a specifically crafted chatbot definition to the preview chat endpoint. This input includes server-side code blocks that bypass the intended security filters. Notably, simply interacting with a standard, pre-configured chatbot does not trigger the bug; the attacker must be able to submit their own custom chatbot structure to the preview function.

Do I need to worry if my Typebot is internal?

According to Halo Surface Signal, Typebot is designed to be embedded in websites, meaning the preview endpoint is often exposed to the public internet by default. If your instance is reachable via the web, it is at higher risk. Even if a deployment is intended for internal use, any network path that allows an unauthenticated user to reach the preview endpoint could be abused.

How can I respond to this vulnerability?

The primary response is to update your Typebot deployment to version 3.16.0 or later, which contains the necessary security fixes. Start by inventorying all Typebot instances in your environment to understand which are active and internet-facing. Once identified, coordinate with your technical team to prioritize patching these systems, as this is the only way to fully remediate the underlying logic flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.