CVE-2026-75856: CodeWhale before 0.8.64 SSRF Bypass via DNS Pinning TOCTOU
CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacks. Attackers can manipulate DNS responses to fail initial resolution checks and succeed on secondary requests, allowing requests to internal IP addresses and bypassing SSRF mitigations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CodeWhaleto a version that resolves this vulnerability.Fixed in 0.8.64
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running a CodeWhale version earlier than 0.8.64 are affected. The issue is reachable over the network and requires no attacker privileges or user interaction.
What does an attacker need to exploit this?
An attacker needs to manipulate DNS responses so that an initial resolution check fails while a subsequent request resolves to an internal IP address. This lets the attacker bypass the DNS-pinning SSRF mitigation and induce server-side requests to internal addresses.
What is the remediation?
Upgrade CodeWhale to version 0.8.64 or later, which is outside the affected version range.