SSRF Bypass in CodeWhale via DNS Pinning TOCTOU

CodeWhale versions before 0.8.64 are susceptible to a server-side request forgery (SSRF) bypass vulnerability (CVE-2026-75856). The flaw resides in the product's DNS pinning logic, which fails to correctly implement protection against time-of-check-time-of-use (TOCTOU) attacks. In a standard secure configuration, an application validates a hostname's resolution to ensure it does not map to an internal, sensitive, or restricted IP address before proceeding with the request.

In this vulnerability, an attacker can manipulate DNS responses such that the initial resolution check - used by CodeWhale to validate the target - succeeds as a benign, external address, while the subsequent actual request resolves to an unauthorized internal address. This bypasses existing SSRF mitigations. If successfully exploited, an attacker could interact with internal services that are not exposed to the public internet, potentially leading to unauthorized data exfiltration or interaction with local network infrastructure.

Attack Chain

1. The attacker configures a malicious DNS server under their control to serve dynamic responses for a specific domain.
2. The attacker triggers CodeWhale to initiate a request to a URL controlled by the attacker.
3. CodeWhale performs an initial DNS lookup of the malicious domain to validate the target address for SSRF protection.
4. The attacker's DNS server responds with a legitimate external IP address to pass the initial validation check.
5. CodeWhale, having validated the address, initiates the secondary connection request to the domain.
6. The attacker's DNS server provides a different, restricted internal IP address (e.g., 127.0.0.1 or 10.x.x.x) for the secondary request.
7. CodeWhale uses the internal IP address for the connection, bypassing the previously applied SSRF checks.
8. The underlying application interacts with the internal resource, facilitating unauthorized access or exfiltration.

Impact

Successful exploitation allows an unauthenticated, remote attacker to bypass SSRF mitigations. This effectively grants the ability to perform requests against internal-only resources, such as internal web services, metadata services, or databases that are inaccessible from the external network. The impact includes potential compromise of internal data, unauthorized control over internal systems, and circumvention of network segmentation security policies.

Recommendation

Prioritize the following actions to address CVE-2026-75856:

• Upgrade CodeWhale to version 0.8.64 or later immediately.
• Audit application access logs for unexpected outbound requests to private or internal IP ranges originating from CodeWhale services.
• If upgrading is not immediately possible, restrict the outgoing network access of the CodeWhale service to only necessary, explicitly allowlisted external endpoints.