Read the docs
TI-2025-40055 Aliases CVE-2025-64709

Typebot May Expose AWS EKS Credentials via Server Side Request Forgery in Webhook Block

Priority HIGH 76CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Typebot is an open-source chatbot builder. In versions prior to 3.13.1, a Server-Side Request Forgery (SSRF) vulnerability in the Typebot webhook block (HTTP Request component) functionality allows authenticated users to make arbitrary HTTP requests from the server, including access to AWS Instance Metadata Service (IMDS). By bypassing IMDSv2 protection through custom header injection, attackers can extract temporary AWS IAM credentials for the EKS node role, leading to complete compromise of the Kubernetes cluster and associated AWS infrastructure. Version 3.13.1 fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00403 34th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed typebot.io (baptisteArno): 3.13.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
baptisteArnotypebot.iobefore 3.13.13.13.1Patch availableCNA
  • typebot.io VendorbaptisteArno Affected before 3.13.1 Fixed in 3.13.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:typebot:typebot:*:*:*:*:*:-:*:*before 3.13.1VulnerablebaptisteArno
  • cpe:2.3:a:typebot:typebot:*:*:*:*:*:-:*:* Versions before 3.13.1 Vulnerable ·baptisteArno

Remediation

  • Fix · CNA typebot.io (baptisteArno) Fixed in 3.13.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-64709

References

Exploit 1

  • TI-2024-20010 typebot.io: `GHSL-2024-040` CVSS 3.1CRITICAL 9.3
  • TI-2025-40251 Typebot Vulnerable to Credential Theft via Client-Side Script Execution and API Authorization Bypass CVSS 3.1HIGH 7.4
  • TI-2025-40052 Typebot IDOR Vulnerability: Unauthorized API Token Deletion and Exposure CVSS 3.1HIGH 7.5
  • TI-2021-07182 Typebot < 1.4.3 - Admin+ Stored Cross Site Scripting CVSS 3.1MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences