CVE-2026-48766
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
TypeBot before version 3.17.0 allows a low-privilege guest member to exfiltrate stored OpenAI-compatible API keys by invoking the OpenAI model-listing helper with an attacker-controlled baseUrl. The vulnerable path decrypts the selected workspace credential and sends the outbound request to the caller-supplied URL, delivering the secret to attacker infrastructure. Version 3.17.0 patches the issue.
Risk Assessment
The risk involves leakage of sensitive OpenAI API keys, potentially leading to unauthorized access and costs associated with API usage. An attacker can compromise credentials and use them for malicious purposes.
Recommendation
Immediately upgrade TypeBot to version 3.17.0 or later. Also restrict guest permissions in workspaces and monitor outbound traffic for unusual requests.
Original NVD description (English source)
TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to exfiltrate stored OpenAI-compatible API keys by invoking the OpenAI model-listing helper with an attacker-controlled `baseUrl`. The vulnerable path decrypts the selected workspace credential, creates an OpenAI client with the secret in both `apiKey` and the explicit `api-key` header, and then sends the outbound request to the caller-supplied URL. Because the permission check accepts any readable workspace member and `listCredentials` reveals credential identifiers to guests, a guest can force the server to deliver the workspace secret to attacker infrastructure. Version 3.17.0 patches the issue.