CVE-2026-48762: SSRF — MEDIUM

CISO Take

TypeBot's OpenAI "Create Transcription" action fetches a user-supplied audio URL server-side without the SSRF guardrails applied elsewhere in the codebase, letting an authenticated low-privilege user redirect that request to internal addresses or localhost. The response is forwarded to OpenAI's Whisper API and the transcription result is handed back to the attacker, turning a normally blind SSRF into an oracle for probing internal services and cloud metadata endpoints reachable from the TypeBot host. There's no known public exploit or Nuclei template, it isn't in CISA KEV, and CISA's own SSVC decision is TRACK — CVSS 5.4 (medium) and an EPSS score of 0.00223 reflect that this isn't being actively chased in the wild today. Even so, any self-hosted TypeBot instance sitting inside a VPC with internal APIs or a cloud metadata service is a plausible target for internal recon by a malicious or compromised low-priv account. Action: upgrade to TypeBot 3.16.0, which routes this fetch through the existing SSRF protection, and in the interim restrict who can create/edit bots with the OpenAI transcription action and egress-filter the TypeBot host from internal-only ranges.

Sources:NVDGitHub AdvisoryEPSSATLAS

What is the risk?

Medium severity (CVSS 5.4, AV:N/AC:L/PR:L/UI:N/C:L/I:L/A:N) — network-reachable and low complexity, but requires an authenticated low-privilege TypeBot account, which narrows the pool of potential attackers to insiders, compromised users, or anyone the platform allows to self-register bots. Impact is confidentiality-only (SSRF read/recon), no integrity or availability loss. No public PoC, no Nuclei coverage, not in CISA KEV, and CISA SSVC rates it TRACK (lowest actionability tier — monitor, no urgent patch mandate). EPSS raw score (0.00223) is low, though the stated percentile (top 87%) suggests some relative exploitation interest; treat this as a real but non-urgent SSRF exposure rather than an imminent threat.

How does the attack unfold?

Initial Access

A low-privilege authenticated TypeBot user configures a bot flow using the OpenAI Create Transcription action and sets the audio URL to an internal or attacker-chosen address.

AML.T0049

SSRF Exploitation

The TypeBot server fetches the supplied URL without applying its normal SSRF protection, reaching internal addresses or localhost on the attacker's behalf.

AML.T0049

Internal Recon via Whisper Feedback

The fetched content is sent to OpenAI's Whisper API for transcription, and the result returned to the attacker reveals whether the internal target was reachable and, if audio-like, its content.

AML.T0006

Impact

The attacker maps internal network topology and potentially exposes data from internal services or cloud metadata endpoints, enabling further lateral movement or credential theft.

Initial Access

A low-privilege authenticated TypeBot user configures a bot flow using the OpenAI Create Transcription action and sets the audio URL to an internal or attacker-chosen address.

AML.T0049

SSRF Exploitation

The TypeBot server fetches the supplied URL without applying its normal SSRF protection, reaching internal addresses or localhost on the attacker's behalf.

AML.T0049

Internal Recon via Whisper Feedback

The fetched content is sent to OpenAI's Whisper API for transcription, and the result returned to the attacker reveals whether the internal target was reachable and, if audio-like, its content.

AML.T0006

Impact

The attacker maps internal network topology and potentially exposes data from internal services or cloud metadata endpoints, enabling further lateral movement or credential theft.

How severe is it?

CVSS 3.1

5.4 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 23% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CLow

ILow

ANone

What should I do?

1 step

Upgrade TypeBot to 3.16.0 or later, which applies the same SSRF protection to the OpenAI transcription handler that already exists elsewhere in the codebase. If immediate upgrade isn't possible: restrict which users/roles can create or edit bots using the OpenAI Create Transcription action; place the TypeBot server behind egress filtering so it cannot reach internal-only ranges, localhost, or the cloud metadata IP (169.254.169.254); and monitor outbound fetch logs from the TypeBot host for requests to internal/private IP ranges or unexpected metadata-service calls as a detection signal.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data ExtractionPrivacy ViolationPluginAPIAgentAML.T0006- Active Scanning AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

NIST AI RMF

MANAGE 4.1-Risk treatments for identified AI system vulnerabilities and errors are identified and implemented

OWASP LLM Top 10

LLM07-Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-48762?

TypeBot's OpenAI "Create Transcription" action fetches a user-supplied audio URL server-side without the SSRF guardrails applied elsewhere in the codebase, letting an authenticated low-privilege user redirect that request to internal addresses or localhost. The response is forwarded to OpenAI's Whisper API and the transcription result is handed back to the attacker, turning a normally blind SSRF into an oracle for probing internal services and cloud metadata endpoints reachable from the TypeBot host. There's no known public exploit or Nuclei template, it isn't in CISA KEV, and CISA's own SSVC decision is TRACK — CVSS 5.4 (medium) and an EPSS score of 0.00223 reflect that this isn't being actively chased in the wild today. Even so, any self-hosted TypeBot instance sitting inside a VPC with internal APIs or a cloud metadata service is a plausible target for internal recon by a malicious or compromised low-priv account. Action: upgrade to TypeBot 3.16.0, which routes this fetch through the existing SSRF protection, and in the interim restrict who can create/edit bots with the OpenAI transcription action and egress-filter the TypeBot host from internal-only ranges.

Is CVE-2026-48762 actively exploited?

No confirmed active exploitation of CVE-2026-48762 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-48762?

Upgrade TypeBot to 3.16.0 or later, which applies the same SSRF protection to the OpenAI transcription handler that already exists elsewhere in the codebase. If immediate upgrade isn't possible: restrict which users/roles can create or edit bots using the OpenAI Create Transcription action; place the TypeBot server behind egress filtering so it cannot reach internal-only ranges, localhost, or the cloud metadata IP (169.254.169.254); and monitor outbound fetch logs from the TypeBot host for requests to internal/private IP ranges or unexpected metadata-service calls as a detection signal.

What systems are affected by CVE-2026-48762?

This vulnerability affects the following AI/ML architecture patterns: Chatbot/agent builder platforms, LLM API integrations, self-hosted AI tool servers.

What is the CVSS score for CVE-2026-48762?

CVE-2026-48762 has a CVSS v3.1 base score of 5.4 (MEDIUM). The EPSS exploitation probability is 0.30%.

What is the AI security impact?

Affected AI Architectures

Chatbot/agent builder platformsLLM API integrationsself-hosted AI tool servers

MITRE ATLAS Techniques

AML.T0006Active Scanning

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

NIST AI RMF: MANAGE 4.1

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

TypeBot is a chatbot builder tool. Prior to version 3.16.0, the OpenAI "Create Transcription" action handler fetches a user-supplied audio URL using `fetch()` without applying the SSRF protection that exists elsewhere in the codebase. An attacker can direct the server to make HTTP requests to arbitrary internal addresses and localhost. The fetched content is passed to the OpenAI Whisper API and the transcription result is returned to the attacker. Version 3.16.0 fixes the issue.

Exploitation Scenario

An attacker with (or who has compromised) a low-privilege TypeBot account builds a bot flow using the OpenAI "Create Transcription" block, setting the audio URL to an internal target such as http://169.254.169.254/latest/meta-data/ or http://localhost:PORT/admin. The TypeBot server fetches that URL server-side and forwards whatever bytes it retrieves to OpenAI's Whisper API for transcription. The attacker observes the transcription result (or lack thereof) to infer whether the internal target responded and, in cases where the response is itself audio content, recovers its transcribed contents — enabling internal network mapping and potential data exposure without ever needing direct network access to those internal systems.

Weaknesses (CWE)

CWE-918Server-Side Request ForgeryPrimary CWE-918Server-Side Request Forgery

CWE-918 — Server-Side Request Forgery: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

[Implementation, Operation] If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
[Implementation, Operation] If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

Source: MITRE CWE corpus.