VYPR
← All advisories
Unrated severityNVD Advisory· Published Jun 17, 2026

TypeBot has SSRF in HTTP request and script fetch flows via DNS rebinding bypass

CVE-2026-48764

Description

TypeBot is a chatbot builder tool. In versions prior to 3.17.2, SSRF validation is implemented by resolving a hostname once and checking whether the resolved IP belongs to a forbidden range allowing for DNS rebinding bypass. The root cause is a time-of-check to time-of-use gap in the SSRF guard. The validator resolves the hostname and approves it, but the later request path performs a fresh resolution and connects to whatever IP the hostname maps to at that moment. The actual outbound request is then performed later using the original hostname, without pinning the validated IP to the network connection. An attacker who can supply a URL to a public bot that performs a server-side HTTP Request block or server-side script fetch can use DNS rebinding to pass the initial validation and still force the server to connect to a private or metadata address during the real request. This enables server-side access to private network services, cloud metadata endpoints, and other internal HTTP targets that the validator was intended to block. The exact downstream impact depends on the reachable internal services. Concrete consequences include metadata disclosure, access to internal admin panels, credential theft from metadata services, and further compromise through internal-only HTTP interfaces. This issue has been fixed in version 3.17.2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

1

Patches

Vulnerability mechanics

Root cause

"Time-of-check to time-of-use (TOCTOU) gap in the SSRF guard: the validator resolves the hostname and checks the IP once, but the subsequent request performs a fresh DNS resolution and connects to whatever IP the hostname maps to at that moment, without pinning the validated IP to the network connection."

Attack vector

An attacker who can supply a URL to a public bot that uses a server-side HTTP Request block or script fetch can exploit a time-of-check to time-of-use (TOCTOU) gap in the SSRF guard [ref_id=1]. The validator resolves the hostname once and approves the IP, but the later request performs a fresh DNS resolution and connects to whatever IP the hostname maps to at that moment. By using a DNS rebinding domain, the attacker makes the initial validation see a benign public IP while the real request resolves to a private or metadata address such as `169.254.169.254` or an RFC1918 internal target. This bypasses the intended SSRF filter and enables server-side access to internal services.

Affected code

The SSRF validation in `packages/lib/src/ssrf/validateHttpReqUrl.ts` resolves a hostname once and checks the resolved IP, but the later request in `packages/lib/src/ky.ts` and `packages/variables/src/executeFunction.ts` performs a fresh DNS resolution and connects to whatever IP the hostname maps to at that moment, without pinning the validated IP to the connection. The same TOCTOU gap exists in the HTTP Request block flow at `packages/bot-engine/src/blocks/integrations/httpRequest/executeHttpRequestBlock.ts` [ref_id=1]. The patch adds an IPv6 unspecified address (`::/128`) block to `validateIPAddress` [patch_id=6466794].

What the fix does

The patch adds a check for the IPv6 unspecified address (`::/128`) in the `validateIPAddress` function, blocking both compressed (`::`) and expanded (`0:0:0:0:0:0:0:0`, `0000:0000:0000:0000:0000:0000:0000:0000`) forms [patch_id=6466794]. It also adds a regression test in `safeKy.test.ts` that verifies requests to `[::]` are rejected before reaching a local IPv6 wildcard listener. However, the patch does not address the fundamental TOCTOU gap — the validator still resolves the hostname separately from the actual request, so DNS rebinding attacks remain possible against hostnames that resolve to other blocked ranges. The advisory notes that the full fix for the TOCTOU issue is not included in this commit [ref_id=1].

Preconditions

  • configThe attacker must have access to a public bot that uses a server-side HTTP Request block or server-side script fetch with attacker-controlled URL input.
  • inputThe attacker must control a DNS rebinding domain that initially resolves to a benign public IP and later resolves to a private or metadata IP.
  • configThe target server must be running TypeBot prior to version 3.17.2.

Generated on Jun 18, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

3

News mentions

0

No linked articles in our index yet.