Is CVE-2026-33712 actively exploited?

No active exploitation of CVE-2026-33712 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-33712 be exploited remotely?

Yes. CVE-2026-33712 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-33712?

CVE-2026-33712 has a CVSS score of 10.0 (CRITICAL).

HOME VULNERABILITIESCVE-2026-33712

CRITICAL

CVE-2026-33712

CWE-862Published: May 22, 2026· Updated: May 22, 2026

10.0

CVSS v3.1

EPSS:0.05%probability of exploitation in 30 daysPercentile:15.9th

Official Description

Typebot is a chatbot builder tool. In versions 3.15.2 and prior, the preview chat endpoint (POST /api/v1/typebots/{typebotId}/preview/startChat) allows unauthenticated users to achieve Server-Side Request Forgery (SSRF) by supplying a custom typebot definition with server-side code blocks. The fetch function exposed inside the isolated-vm sandbox calls Node.js native fetch without the SSRF validation (validateHttpReqUrl) that protects the HTTP Request block. This bypasses all SSRF mitigations added after GHSA-8gq9-rw7v-3jpr. Exploitation of this unauthenticated SSRF vulnerability can lead to cloud credential theft, internal network access and data exfiltration for any self-hosted Typebot deployments and hosted services. This issue has been fixed in version 3.16.0.

NVD Source

Risk Analysis

This critical vulnerability in Typebot allows unauthenticated Server-Side Request Forgery (SSRF) through its preview chat endpoint. Attackers can supply custom typebot definitions with server-side code blocks to bypass existing SSRF validations. With a perfect CVSS score of 10.0, this flaw poses an extreme risk, potentially leading to cloud credential theft, internal network access, and data exfiltration.

No public exploit is currently known for this vulnerability. The flaw is remotely exploitable (AV:N) without any authentication (PR:N) or user interaction (UI:N).

Recommended Action

Upgrade Typebot to version 3.16.0 or later immediately to fix this SSRF vulnerability. For self-hosted deployments, ensure all instances are updated to the patched version.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2026-33712 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 10.0.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.