DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-75856: CVE-2026-75856: Server-Side Request Forgery (SSRF) Bypass via DNS Resolution TOCTOU in CodeWhale

#security #cve #cybersecurity

CVE-2026-75856: Server-Side Request Forgery (SSRF) Bypass via DNS Resolution TOCTOU in CodeWhale

Vulnerability ID: CVE-2026-75856
CVSS Score: 9.2
Published: 2026-09-04

A critical Server-Side Request Forgery (SSRF) bypass vulnerability exists in CodeWhale before version 0.8.64 (and version 0.8.41 in the 0.8.x branch) due to a Time-of-Check to Time-of-Use (TOCTOU) bug in its DNS pre-flight validation mechanism. By returning a temporary resolution failure during validation and subsequently resolving to restricted IPs during HTTP execution, attackers can bypass security rules.

TL;DR

A Time-of-Check to Time-of-Use (TOCTOU) flaw in CodeWhale's DNS validation logic allows unauthenticated attackers to bypass SSRF protections by intentionally failing the initial DNS resolution and resolving to a restricted IP during the subsequent HTTP request.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-918: Server-Side Request Forgery (SSRF)
  • Attack Vector: Network
  • CVSS v4.0 Score: 9.2 (Critical)
  • EPSS Score: 0.0037 (Percentile: 30.08%)
  • Impact: High Confidentiality Breach
  • Exploit Status: Proof-of-Concept in tests; no weaponized exploits
  • KEV Status: Not listed

Affected Systems

  • CodeWhale
  • CodeWhale: >= 0.8.5, < 0.8.41 (Fixed in: 0.8.41)
  • CodeWhale: >= 0.8.41, < 0.8.64 (Fixed in: 0.8.64)

Code Analysis

Commit: 26de44a

Fix SSRF bypass via DNS pre-flight check, resolve workspace path symlink traversals, and sanitize environment secrets in JS execution.

Mitigation Strategies

  • Upgrade CodeWhale instances to version 0.8.64 or 0.8.41 (legacy branch) immediately.
  • Implement egress firewall rules to block outbound connections from the application server to RFC 1918 ranges and the link-local address 169.254.169.254.
  • Configure container runtime networks to isolate CodeWhale from local or loopback system ports.

Remediation Steps:

  1. Identify all deployment instances of CodeWhale below version 0.8.64.
  2. Pull the latest Docker image or update the cargo dependency to CodeWhale >= 0.8.64.
  3. Restart the application services and verify the fix by running the unresolvable hostname unit test.

References

Read the full report for CVE-2026-75856 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)