CVE-2026-48766: guest role exfiltrates OpenAI keys

CISO Take

TypeBot, a self-hosted chatbot builder, lets any low-privilege guest member of a workspace steal the OpenAI-compatible API key configured for that workspace by pointing the built-in model-listing helper at an attacker-controlled URL — the server dutifully decrypts the stored secret and ships it, in both the request body and an api-key header, to whatever endpoint the guest supplies. This matters because the bug chains two failures common in AI SaaS platforms: an overly permissive authorization check that treats "can read the workspace" as "can use its credentials," and a server-side request forgery primitive baked into an AI-vendor integration feature. There's no CISA KEV listing, no public exploit or Nuclei template, and EPSS sits at 0.3% (though in the top 76th percentile of all scored CVEs), so this isn't being mass-exploited — but the CVSS 7.6 (network, no user interaction, low complexity) reflects that any tenant with a guest invite can trivially pull a paid OpenAI key out of another workspace's config. Patch to TypeBot 3.17.0 immediately if you self-host it; in the interim, rotate any OpenAI-compatible API keys stored in TypeBot workspaces and audit outbound network logs for unexpected calls to the OpenAI model-listing endpoint with non-standard `baseUrl` values.

Sources:NVDGitHub AdvisoryEPSSCISA KEVATLAS

What is the risk?

Exploitability is high in relative terms — no user interaction, network-reachable, low attack complexity, and the only precondition is possessing a low-privilege guest role that TypeBot itself is designed to grant broadly to collaborators. Impact is bounded to confidentiality (C:H) with limited integrity/availability effect (I:L/A:L), consistent with a targeted credential-theft primitive rather than full system compromise. Real-world exploitation pressure is currently low (EPSS 0.315%, no KEV entry, no public PoC or scanner template, CISA SSVC = TRACK), but the attack requires no special AI/ML expertise beyond understanding SSRF and API credential flows, so the barrier to exploitation is low once an attacker has any guest-level workspace access — including via social engineering or a compromised low-trust internal account.

How does the attack unfold?

Initial Access

Attacker obtains a low-privilege guest role in a target TypeBot workspace via invite, social engineering, or a compromised low-trust account.

Discovery

Attacker calls listCredentials, which reveals OpenAI-compatible credential identifiers in the workspace even though guests lack permission to use them directly.

AML.T0007

Exfiltration via SSRF

Attacker invokes the model-listing helper with the discovered credential ID and an attacker-controlled baseUrl, causing the server to decrypt the secret and send it to attacker infrastructure.

AML.T0025

Impact

Attacker captures the plaintext OpenAI API key and reuses it outside TypeBot for billing abuse, data access, or further pivoting.

AML.T0091.000

Initial Access

Attacker obtains a low-privilege guest role in a target TypeBot workspace via invite, social engineering, or a compromised low-trust account.

Discovery

Attacker calls listCredentials, which reveals OpenAI-compatible credential identifiers in the workspace even though guests lack permission to use them directly.

AML.T0007

Exfiltration via SSRF

Attacker invokes the model-listing helper with the discovered credential ID and an attacker-controlled baseUrl, causing the server to decrypt the secret and send it to attacker infrastructure.

AML.T0025

Impact

Attacker captures the plaintext OpenAI API key and reuses it outside TypeBot for billing abuse, data access, or further pivoting.

AML.T0091.000

How severe is it?

CVSS 3.1

7.6 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 37% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

ILow

ALow

What should I do?

1 step

Upgrade TypeBot to 3.17.0 or later immediately — the patch fixes both the permission check (guests should not be able to invoke privileged credential-bearing helpers) and the SSRF-enabling baseUrl trust issue. Until patched, restrict guest workspace roles to trusted users only, or disable/limit third-party AI credential connectors for workspaces with guest members. Rotate all OpenAI-compatible API keys stored in any TypeBot workspace that has ever had a guest member, since prior exposure cannot be ruled out. For detection, review outbound request logs from the TypeBot server for calls to the model-listing endpoint carrying non-default baseUrl parameters, and monitor OpenAI API usage/billing dashboards for anomalous activity or requests originating from unexpected IP ranges.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassData LeakageAPIAML.T0025- Exfiltration via Cyber Means AML.T0055- Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

NIST AI RMF

GOVERN-6.1-Third-party AI resource risk management

OWASP LLM Top 10

LLM02:2025-Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-48766?

TypeBot, a self-hosted chatbot builder, lets any low-privilege guest member of a workspace steal the OpenAI-compatible API key configured for that workspace by pointing the built-in model-listing helper at an attacker-controlled URL — the server dutifully decrypts the stored secret and ships it, in both the request body and an api-key header, to whatever endpoint the guest supplies. This matters because the bug chains two failures common in AI SaaS platforms: an overly permissive authorization check that treats "can read the workspace" as "can use its credentials," and a server-side request forgery primitive baked into an AI-vendor integration feature. There's no CISA KEV listing, no public exploit or Nuclei template, and EPSS sits at 0.3% (though in the top 76th percentile of all scored CVEs), so this isn't being mass-exploited — but the CVSS 7.6 (network, no user interaction, low complexity) reflects that any tenant with a guest invite can trivially pull a paid OpenAI key out of another workspace's config. Patch to TypeBot 3.17.0 immediately if you self-host it; in the interim, rotate any OpenAI-compatible API keys stored in TypeBot workspaces and audit outbound network logs for unexpected calls to the OpenAI model-listing endpoint with non-standard `baseUrl` values.

Is CVE-2026-48766 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-48766, increasing the risk of exploitation.

How to fix CVE-2026-48766?

Upgrade TypeBot to 3.17.0 or later immediately — the patch fixes both the permission check (guests should not be able to invoke privileged credential-bearing helpers) and the SSRF-enabling `baseUrl` trust issue. Until patched, restrict guest workspace roles to trusted users only, or disable/limit third-party AI credential connectors for workspaces with guest members. Rotate all OpenAI-compatible API keys stored in any TypeBot workspace that has ever had a guest member, since prior exposure cannot be ruled out. For detection, review outbound request logs from the TypeBot server for calls to the model-listing endpoint carrying non-default `baseUrl` parameters, and monitor OpenAI API usage/billing dashboards for anomalous activity or requests originating from unexpected IP ranges.

What systems are affected by CVE-2026-48766?

This vulnerability affects the following AI/ML architecture patterns: conversational AI / chatbot platforms, LLM API integrations, multi-tenant AI SaaS credential stores.

What is the CVSS score for CVE-2026-48766?

CVE-2026-48766 has a CVSS v3.1 base score of 7.6 (HIGH). The EPSS exploitation probability is 0.43%.

What is the AI security impact?

Affected AI Architectures

conversational AI / chatbot platformsLLM API integrationsmulti-tenant AI SaaS credential stores

MITRE ATLAS Techniques

AML.T0025Exfiltration via Cyber Means

AML.T0055Unsecured Credentials

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: GOVERN-6.1

OWASP LLM Top 10: LLM02:2025

What are the technical details?

Original Advisory

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to exfiltrate stored OpenAI-compatible API keys by invoking the OpenAI model-listing helper with an attacker-controlled `baseUrl`. The vulnerable path decrypts the selected workspace credential, creates an OpenAI client with the secret in both `apiKey` and the explicit `api-key` header, and then sends the outbound request to the caller-supplied URL. Because the permission check accepts any readable workspace member and `listCredentials` reveals credential identifiers to guests, a guest can force the server to deliver the workspace secret to attacker infrastructure. Version 3.17.0 patches the issue.

Exploitation Scenario

An attacker gains guest-level access to a target organization's TypeBot workspace — via a legitimate collaboration invite, a phished internal account, or an intentionally over-shared workspace link. They call `listCredentials` to enumerate the OpenAI-compatible credential IDs configured for that workspace, which TypeBot exposes even to guests despite lacking direct use permission. The attacker then invokes the model-listing helper, selecting the discovered credential ID but supplying their own attacker-controlled `baseUrl` instead of the legitimate OpenAI endpoint. The TypeBot server decrypts the stored API key, builds an OpenAI client embedding the secret in both the `apiKey` field and an `api-key` header, and sends the outbound request to the attacker's server — which simply logs the incoming headers/body to capture the plaintext key. The attacker now holds a valid OpenAI API key usable for billing abuse, data access, or further pivoting, entirely outside TypeBot's visibility.

Weaknesses (CWE)

CWE-200Exposure of Sensitive Information to an Unauthorized ActorPrimary CWE-200Exposure of Sensitive Information to an Unauthorized Actor

CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.