CVE-2026-48766 TypeBot vulnerable to OpenAI API key exfiltration in listModels via attacker-controlled baseUrl
A low-privilege guest can exfiltrate stored OpenAI API keys by forcing the server to send requests to an attacker-controlled URL via the listModels function.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-48766?
CVE-2026-48766 is a high-severity server-side request forgery vulnerability in baptisteArno typebot.io, published on 11 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to exfiltrate stored OpenAI-compatible API keys by invoking the OpenAI model-listing helper with an attacker-controlled `baseUrl`. The vulnerable path decrypts the selected workspace credential, creates an OpenAI client with the secret in both `apiKey` and the explicit `api-key` header, and then sends the outbound request to the caller-supplied URL. Because the permission check accepts any readable workspace member and `listCredentials` reveals credential identifiers to guests, a guest can force the server to deliver the workspace secret to attacker infrastructure. Version 3.17.0 patches the issue.
Weakness: CWE-200
Which versions are affected by CVE-2026-48766?
How do I fix CVE-2026-48766?
No fix has been published for CVE-2026-48766 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-48766 being exploited?
There is no known exploitation of CVE-2026-48766 in the wild and no public exploit code.
Sources
Also known as GHSA-gc3v-9whw-6wjh.