{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/codewhale/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.6,"id":"CVE-2026-75856"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["CodeWhale","CodeWhale (0.8.64)","CodeWhale (0.8.x)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","argument-injection","code-execution","remote-code-execution","credential-theft"],"_cs_type":"advisory","_cs_vendors":["Hmbown"],"content_html":"\u003cp\u003eCodeWhale versions before 0.8.64 are susceptible to a server-side request forgery (SSRF) bypass vulnerability (CVE-2026-75856). The flaw resides in the product's DNS pinning logic, which fails to correctly implement protection against time-of-check-time-of-use (TOCTOU) attacks. In a standard secure configuration, an application validates a hostname's resolution to ensure it does not map to an internal, sensitive, or restricted IP address before proceeding with the request.\u003c/p\u003e\n\u003cp\u003eIn this vulnerability, an attacker can manipulate DNS responses such that the initial resolution check - used by CodeWhale to validate the target - succeeds as a benign, external address, while the subsequent actual request resolves to an unauthorized internal address. This bypasses existing SSRF mitigations. If successfully exploited, an attacker could interact with internal services that are not exposed to the public internet, potentially leading to unauthorized data exfiltration or interaction with local network infrastructure.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker configures a malicious DNS server under their control to serve dynamic responses for a specific domain.\u003c/li\u003e\n\u003cli\u003eThe attacker triggers CodeWhale to initiate a request to a URL controlled by the attacker.\u003c/li\u003e\n\u003cli\u003eCodeWhale performs an initial DNS lookup of the malicious domain to validate the target address for SSRF protection.\u003c/li\u003e\n\u003cli\u003eThe attacker's DNS server responds with a legitimate external IP address to pass the initial validation check.\u003c/li\u003e\n\u003cli\u003eCodeWhale, having validated the address, initiates the secondary connection request to the domain.\u003c/li\u003e\n\u003cli\u003eThe attacker's DNS server provides a different, restricted internal IP address (e.g., 127.0.0.1 or 10.x.x.x) for the secondary request.\u003c/li\u003e\n\u003cli\u003eCodeWhale uses the internal IP address for the connection, bypassing the previously applied SSRF checks.\u003c/li\u003e\n\u003cli\u003eThe underlying application interacts with the internal resource, facilitating unauthorized access or exfiltration.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated, remote attacker to bypass SSRF mitigations. This effectively grants the ability to perform requests against internal-only resources, such as internal web services, metadata services, or databases that are inaccessible from the external network. The impact includes potential compromise of internal data, unauthorized control over internal systems, and circumvention of network segmentation security policies.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the following actions to address CVE-2026-75856:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade CodeWhale to version 0.8.64 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit application access logs for unexpected outbound requests to private or internal IP ranges originating from CodeWhale services.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately possible, restrict the outgoing network access of the CodeWhale service to only necessary, explicitly allowlisted external endpoints.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-18T16:56:51Z","date_published":"2026-08-18T16:55:56Z","id":"https://feed.craftedsignal.io/briefs/2026-08-codewhale-ssrf-bypass/","summary":"CodeWhale versions before 0.8.64 contain a time-of-check-time-of-use vulnerability in DNS pinning logic, allowing attackers to bypass SSRF mitigations and access internal resources.","title":"SSRF Bypass in CodeWhale via DNS Pinning TOCTOU","url":"https://feed.craftedsignal.io/briefs/2026-08-codewhale-ssrf-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - CodeWhale","version":"https://jsonfeed.org/version/1.1"}