{"uuid": "f9a87ab1-5ae8-497e-b969-eed16010eafd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-75856", "type": "seen", "source": "https://gist.github.com/alon710/e9c9321eb429f1e237680df95cb576b8", "content": "# CVE-2026-75856: CVE-2026-75856: Server-Side Request Forgery (SSRF) Bypass via DNS Resolution TOCTOU in CodeWhale\n\n> **CVSS Score:** 9.2\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-75856\n\n## Summary\nA critical Server-Side Request Forgery (SSRF) bypass vulnerability exists in CodeWhale before version 0.8.64 (and version 0.8.41 in the 0.8.x branch) due to a Time-of-Check to Time-of-Use (TOCTOU) bug in its DNS pre-flight validation mechanism. By returning a temporary resolution failure during validation and subsequently resolving to restricted IPs during HTTP execution, attackers can bypass security rules.\n\n## TL;DR\nA Time-of-Check to Time-of-Use (TOCTOU) flaw in CodeWhale's DNS validation logic allows unauthenticated attackers to bypass SSRF protections by intentionally failing the initial DNS resolution and resolving to a restricted IP during the subsequent HTTP request.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918: Server-Side Request Forgery (SSRF)\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 9.2 (Critical)\n- **EPSS Score**: 0.0037 (Percentile: 30.08%)\n- **Impact**: High Confidentiality Breach\n- **Exploit Status**: Proof-of-Concept in tests; no weaponized exploits\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- CodeWhale\n- **CodeWhale**: >= 0.8.5, < 0.8.41 (Fixed in: `0.8.41`)\n- **CodeWhale**: >= 0.8.41, < 0.8.64 (Fixed in: `0.8.64`)\n\n## Mitigation\n\n- Upgrade CodeWhale instances to version 0.8.64 or 0.8.41 (legacy branch) immediately.\n- Implement egress firewall rules to block outbound connections from the application server to RFC 1918 ranges and the link-local address 169.254.169.254.\n- Configure container runtime networks to isolate CodeWhale from local or loopback system ports.\n\n**Remediation Steps:**\n1. Identify all deployment instances of CodeWhale below version 0.8.64.\n2. Pull the latest Docker image or update the cargo dependency to CodeWhale >= 0.8.64.\n3. Restart the application services and verify the fix by running the unresolvable hostname unit test.\n\n## References\n\n- [NVD CVE-2026-75856 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-75856)\n- [CVE Org Authoritative Record](https://www.cve.org/CVERecord?id=CVE-2026-75856)\n- [Official Security Advisory (GHSA)](https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-6v2g-fpxh-pmmh)\n- [Patch Commit on GitHub](https://github.com/Hmbown/CodeWhale/commit/26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e)\n- [VulnCheck Third-Party Advisory](https://www.vulncheck.com/advisories/codewhale-before-ssrf-bypass-via-dns-pinning-toctou)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-75856) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-05T14:31:44.532904Z"}