CVE-2025-64709 is a critical (CVSS 9.6) server-side request forgery in the webhook block of Typebot, the open source chatbot builder. Authenticated users could make the server send arbitrary requests, including to the AWS instance metadata service. Version 3.13.1 fixes it.
What's affected
The NVD record says Typebot versions before 3.13.1 are affected and 3.13.1 fixes the issue. The source is advisory GHSA-8gq9-rw7v-3jpr in the typebot.io repository. We could not retrieve the advisory body, so the details below come from the NVD record.
The attacker must be an authenticated user who can build or edit a bot with an HTTP request component. The record says IMDSv2 protection could be bypassed through custom header injection, and that stolen temporary credentials for the Kubernetes node role could lead to a compromise of the cluster and the surrounding AWS account. The changed scope in the CVSS vector reflects that reach.
How to check if you're exposed
Check your Typebot version. For containers or Kubernetes:
docker ps --format '{{.Names}} {{.Image}}'
kubectl get pods -A -o jsonpath='{range .items[*]}{.spec.containers[*].image}{"\n"}{end}' | grep -i typebot
Anything below 3.13.1 is in scope. Then review the surrounding AWS setup. Which role does the node running Typebot have? How much can it do? Check the metadata options on your instances or node groups. You can read them with the AWS CLI:
aws ec2 describe-instances --query "Reservations[].Instances[].MetadataOptions"
Look at the hop limit and whether tokens are required. Finally, list the people with accounts on your Typebot workspace, since the attacker needs to be a signed in user.
What to do now
- Upgrade Typebot to 3.13.1 or later.
- Limit who can create accounts and who can edit bots in your workspace.
- Lower the privileges of the node role used where Typebot runs, so a leaked credential reaches as little as possible.
- As general hardening, set the metadata hop limit to 1 and consider blocking pod access to the metadata address with a network policy.
- Review CloudTrail for use of the node role from unfamiliar addresses, and rotate credentials if you see any.
Why it matters
The record lists CWE-918, server-side request forgery. The webhook feature exists to make HTTP calls on a user's behalf, which is useful and risky in the same breath. Without controls on where those calls may go, the server becomes a proxy into its own network, including link local addresses such as the cloud metadata service.
IMDSv2 was designed to reduce this class of attack, but the record says the protection could be sidestepped by controlling request headers. The wider lesson is about blast radius: a node role with broad permissions turns a chatbot builder flaw into a cluster and cloud account problem. The record does not mark the CVE as known exploited.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does the attacker need an account?
Yes. The record describes authenticated users, and the CVSS vector shows low privileges required.
Does IMDSv2 protect me?
The record says IMDSv2 protection could be bypassed in this case. Upgrade, and reduce the node role's permissions as well.
Sources
Last reviewed: 18 October 2026.
