CVE-2026-48766: TypeBot vulnerable to OpenAI API key exfiltration in listModels via attacker-controlled baseUrl
TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to exfiltrate stored OpenAI-compatible API keys by invoking the OpenAI model-listing helper with an attacker-controlled baseUrl. The vulnerable path decrypts the selected workspace credential, creates an OpenAI client with the secret in both apiKey and the explicit api-key header, and then sends the outbound request to the caller-supplied URL. Because the permission check accepts any readable workspace member and listCredentials reveals credential identifiers to guests, a guest can force the server to deliver the workspace secret to attacker infrastructure. Version 3.17.0 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TypeBotto a version that resolves this vulnerability.Fixed in 3.17.0 - Compensating control
Restrict/validate the OpenAI-compatible model-listing helper so that calls do not use attacker-controlled baseUrl (block outbound requests from the service to untrusted caller-supplied URLs until TypeBot 3.17.0 is applied).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48766?
CVE-2026-48766 has a high severity rating of 7.6.
How do I fix CVE-2026-48766?
To fix CVE-2026-48766, upgrade to TypeBot version 3.17.0 or later.
What type of vulnerability is CVE-2026-48766?
CVE-2026-48766 is an information leakage vulnerability that allows API key exfiltration.
Who is affected by CVE-2026-48766?
Low-privilege guest members of a workspace using TypeBot prior to version 3.17.0 are affected.
What can attackers do with CVE-2026-48766?
Attackers can exfiltrate stored OpenAI-compatible API keys using an attacker-controlled baseUrl.