CVE-2026-48766
Received Received - Intake

OpenAI API Key Exfiltration in TypeBot

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: GitHub, Inc.

Description
TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to exfiltrate stored OpenAI-compatible API keys by invoking the OpenAI model-listing helper with an attacker-controlled `baseUrl`. The vulnerable path decrypts the selected workspace credential, creates an OpenAI client with the secret in both `apiKey` and the explicit `api-key` header, and then sends the outbound request to the caller-supplied URL. Because the permission check accepts any readable workspace member and `listCredentials` reveals credential identifiers to guests, a guest can force the server to deliver the workspace secret to attacker infrastructure. Version 3.17.0 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-48766
EUVD
EUVD-2026-56238

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
baptistearno typebot to 3.17.0 (exc)
baptistearno typebot 3.17.0
typebot typebot to 3.17.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-48766 is a vulnerability in TypeBot versions before 3.17.0. It allows a low-privilege guest member of a workspace to steal stored OpenAI-compatible API keys. The guest can trick the server into sending the decrypted API key to an attacker-controlled URL by using a malicious baseUrl parameter in the OpenAI model-listing helper. The server decrypts the workspace credential and includes the API key in both the apiKey field and the explicit api-key header when making the request.

Detection Guidance

Check Typebot server logs for suspicious outbound requests to unknown URLs, particularly those involving OpenAI model-listing endpoints with custom baseUrl parameters. Monitor for unauthorized access attempts by guest users to credential management functions.

Impact Analysis

An attacker could use the stolen API key to consume the victim's billing quota, access their data, or maintain persistent access until the key is rotated. The attack requires only guest membership in the workspace, knowledge of the workspace ID, and control over an HTTP endpoint.

Mitigation Strategies

Upgrade Typebot to version 3.17.0 or later. Remove guest access to workspace credentials and restrict credential listing to privileged users only. Review and rotate all exposed OpenAI-compatible API keys.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48766. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart