CVE-2026-48764: TypeBot DNS Rebinding SSRF Vulnerability in Versions Before 3.17.2

Technical summary

CVE-2026-48764 is a Server-Side Request Forgery (SSRF) vulnerability rooted in a Time-of-Check Time-of-Use (TOCTOU) flaw in TypeBot's hostname validation logic. The vulnerability exists in the HTTP request and script fetch features available to public bots. The validation layer resolves a user-supplied hostname and verifies the resulting IP against a blocklist of forbidden ranges (private IPs, metadata endpoints, etc.). However, this validation result is not persisted or pinned to the subsequent network operation. When the actual outbound request is made, the hostname is resolved again—potentially returning a different IP address if the attacker controls the DNS response. The second resolution can point to a restricted internal service while the first passed validation. The vulnerability affects versions prior to 3.17.2, where the fix implements IP pinning to ensure the validated IP matches the target of the actual connection.

Business impact

Organizations using TypeBot to accept user-supplied URLs in bot workflows face potential data exposure and system compromise. An attacker controlling a domain or able to perform DNS spoofing can craft requests that bypass SSRF protections and reach internal services such as cloud metadata endpoints (AWS IMDSv1, Google GCP metadata), private admin dashboards, internal APIs, and configuration management systems. In cloud environments, metadata endpoint access can lead to credential theft, allowing an attacker to assume the identity of the underlying cloud service. In on-premises deployments, the vulnerability enables reconnaissance and access to internal HTTP services. The impact is amplified when bots have network access to sensitive infrastructure or when credentials are stored in metadata services.

Affected systems

TypeBot versions prior to 3.17.2 are affected. The vulnerability applies specifically to bots that use the 'server-side HTTP Request' block or 'server-side script fetch' functionality, which must be configured to accept dynamic or user-supplied URLs. Self-hosted TypeBot instances and cloud-hosted instances running vulnerable versions are both affected. Organizations should verify their deployed version against the 3.17.2 release.

Exploitability

Exploitation requires low preconditions: the attacker needs either control of a domain that can be supplied to a vulnerable bot or the ability to influence DNS responses (local network position or BGP hijacking in high-threat scenarios). The CVSS score of 8.2 (HIGH) reflects that no authentication or user interaction is required—any public bot endpoint accepting URLs can be targeted. The attack is reliable once DNS rebinding conditions are met, making it a practical threat in environments where bots accept external input.

Remediation

Upgrade TypeBot to version 3.17.2 or later. The patch implements IP address pinning: the validated IP from the initial SSRF check is now bound to the network connection, preventing the second DNS resolution from being used to redirect to a different target. Organizations running TypeBot should prioritize this upgrade, particularly if bots accept user-supplied URLs or are exposed to untrusted input. After patching, verify that bots continue to function correctly with legitimate internal service integrations, as the stricter validation may affect previously permissive configurations.

Patch guidance

Deploy TypeBot 3.17.2 or a later version. The fix modifies the SSRF validation to store and enforce the IP address determined during the initial check, ensuring the actual HTTP connection uses the same target IP. Verify the upgrade in a staging environment if possible, especially if TypeBot bots integrate with internal services—confirm that legitimate internal requests still succeed after the patch. No configuration changes are required; the fix is transparent to end users. Review bot configurations to ensure no bots are inadvertently attempting to reach now-blocked internal services.

Detection guidance

Monitor TypeBot access logs for requests to suspicious or uncommon destinations, particularly those targeting metadata endpoints (169.254.169.254 for AWS, 10.x.x.x or 172.x.x.x ranges for private networks, 127.0.0.1 for localhost). Look for bot invocations that include unusual URLs pointing to internal infrastructure. Enable DNS query logging to detect suspicious DNS patterns, such as rapid re-resolution of the same domain with different results (a hallmark of rebinding attacks). Check network egress from TypeBot hosts for unexpected connections to internal services. If TypeBot is deployed on cloud infrastructure, monitor for anomalous access to metadata endpoints and correlate with bot activity logs.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH severity (CVSS 8.2), ease of exploitation (no authentication required), and direct access to sensitive infrastructure. The attack vector is network-accessible and requires minimal sophistication. Organizations operating TypeBot instances in cloud environments face heightened risk due to metadata endpoint exposure. The ability to extract cloud credentials makes this a critical path to broader account compromise. Even in isolated networks, the vulnerability enables internal reconnaissance and service exploitation.

Risk score, explained

The CVSS 3.1 score of 8.2 reflects: AV:N (network-accessible, no special network position required), AC:L (low attack complexity, DNS rebinding is a well-understood technique), PR:N (no privileges required), UI:N (no user interaction needed), S:U (impact is scoped to the vulnerable system), C:H (high confidentiality impact via metadata/credential disclosure), I:L (low integrity impact—ability to access internal services may enable modification), A:N (no availability impact). The score appropriately weighs the practical exploitability against the sensitive nature of potential targets.

Frequently asked questions