CVE-2026-33712 — Typebot

Key facts

CVE-2026-33712 (Typebot) is a Critical (10.0) vulnerability: Typebot. This entry ships ready-to-deploy detection and prevention rules (Snort) plus a detection-only PoC and a Docker test lab.

CVE	CVE-2026-33712
Severity	Critical (10.0)
Vendor	Typebot
Product	Typebot
Detection / prevention	Snort
PoC	poc.py
Source	2026/CVE-2026-33712/

Details

CVE-2026-33712 (Typebot) is a Critical (10.0) vulnerability: Typebot. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort) — see Detection and prevention below. Source: NVD record.

Overview

Field	Value
CVE	CVE-2026-33712
CVSS	10.0 (Critical)
Vendor	Typebot
Product	Typebot
Affected	Typebot <= 3.15.2 (self-hosted instances)
Fixed	Upgrade to Typebot > 3.15.2

Root Cause

The Typebot preview endpoint POST /api/v1/typebots/{id}/startChat (and its alias POST /api/v1/typebots/{id}/preview/startChat) is reachable without any authentication token. The endpoint accepts a startVariables JSON body that can include arbitrary URL references for webhook callbacks, external data sources, and integration targets. Because no authentication middleware is applied and no SSRF filtering (allowlist, blocklist, or private IP range restriction) exists on outbound HTTP requests initiated by the chat engine, an attacker can supply arbitrary internal URLs.

Problem

An unauthenticated remote attacker can send a crafted POST request to the preview endpoint with a startVariables payload referencing internal network addresses:

• Internal network reconnaissance: Probe services on 169.254.0.0/16 (cloud metadata), 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 to map the internal infrastructure.
• Cloud metadata exfiltration: On AWS/GCP/Azure, retrieve instance metadata including IAM credentials via http://169.254.169.254/latest/meta-data/.
• Remote Code Execution: Chain SSRF against internal services (e.g., unauthenticated Redis, internal admin APIs, or Kubernetes API server) to escalate to full RCE on the host or adjacent systems.
• Data exfiltration: Read responses from internal databases or configuration endpoints and exfiltrate them through the SSRF response body.

No credentials or prior account registration are required.

Detection

Run the proof-of-concept against your Typebot instance:

python poc.py --url https://<typebot-host> --typebot-id <bot-id> --ssrf-target http://169.254.169.254/latest/meta-data/

The PoC issues an unauthenticated POST to the preview endpoint and checks whether the response body contains content from the SSRF target. A vulnerable instance returns internal service data in the chat response.

Manual test:

curl -s -X POST https://<host>/api/v1/typebots/<id>/preview/startChat \
  -H 'Content-Type: application/json' \
  -d '{"startVariables":{"webhookUrl":"http://169.254.169.254/latest/meta-data/"}}'  

Remediation

1. Upgrade immediately: Update Typebot to a version > 3.15.2 which adds authentication requirements to all preview endpoints and implements SSRF mitigations.
2. Restrict preview endpoint access: If upgrade is not immediately possible, place the Typebot instance behind a reverse proxy (nginx/Caddy) and block external access to /api/v1/typebots/*/preview/*.
3. Implement network-level egress filtering: Configure firewall rules on the Typebot host to block outbound connections to RFC 1918 and link-local ranges (169.254.0.0/16, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
4. Disable cloud metadata endpoint access: On cloud instances, use instance firewall rules or IMDSv2 enforcement (AWS) to prevent unauthorized metadata access.
5. Rotate any exposed credentials: If exploitation is suspected, rotate all credentials accessible from the compromised host (cloud IAM keys, DB passwords, API tokens).

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-33712
• Typebot GitHub: https://github.com/baptisteArno/typebot.io
• OWASP SSRF Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html

Detection and prevention

Ready-to-deploy defensive rules for CVE-2026-33712, for authorized testing and blue-team detection engineering:

• Snort IDS signature — prevention/snort.rules
• Detection-only PoC — poc.py
• Rule notes — prevention/README.md

References: NVD — CVE-2026-33712 · full write-up on the searchable site

Detection & prevention rules

Snort IDS signature

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"CVE-2026-33712 Typebot SSRF unauthenticated POST to preview/startChat"; flow:to_server,established; content:"POST"; http_method; content:"/api/v1/typebots/"; http_uri; content:"/preview/startChat"; http_uri; classtype:web-application-attack; sid:9002694; rev:1;)
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"CVE-2026-33712 Typebot SSRF internal address in startChat body"; flow:to_server,established; content:"POST"; http_method; content:"/preview/startChat"; http_uri; pcre:"/(?:http|https|file|ftp|dict|gopher):\/\/(?:127\.|10\.|172\.1[6-9]\.|172\.2[0-9]\.|192\.168\.)/i"; http_client_body; classtype:attempted-recon; sid:9002695; rev:1;)
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"CVE-2026-33712 Typebot SSRF localhost or metadata reference in startChat"; flow:to_server,established; content:"POST"; http_method; content:"/preview/startChat"; http_uri; pcre:"/(?:localhost|169\.254\.169\.254|metadata\.google)/i"; http_client_body; classtype:web-application-attack; sid:9002696; rev:1;)

:material-file-download: prevention/snort.rules

Frequently asked questions

What is CVE-2026-33712?

CVE-2026-33712 (Typebot) is a Critical (10.0) vulnerability: Typebot. This entry ships ready-to-deploy detection and prevention rules (Snort) plus a detection-only PoC and a Docker test lab.

How do I detect CVE-2026-33712?

Deploy the Snort detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2026-33712?

Upgrade to a fixed version per the vendor advisory; the NVD record lists the affected versions. Use the included PoC to verify your remediation.

---

For authorized security testing and research only. See the full source and NVD record.