Server-Side Request Forgery Vulnerability in Typebot Chatbot Builder from Typebot

CVE-2025-64709

What is CVE-2025-64709?

The Typebot chatbot builder, specifically in versions prior to 3.13.1, is susceptible to a Server-Side Request Forgery (SSRF) vulnerability in its webhook block functionality. This security flaw allows authenticated users to issue arbitrary HTTP requests from the server. Notably, it can be exploited to access the AWS Instance Metadata Service (IMDS). Attackers can circumvent IMDSv2 protections via custom header manipulation, which may allow them to retrieve temporary AWS IAM credentials tied to the EKS node role. This can lead to a situation where an attacker gains full control over the Kubernetes cluster and the associated AWS infrastructure. Users are urged to update to version 3.13.1 or later to remediate this vulnerability.

References