Server-Side Request Forgery Bypass in CodeWhale by Hmbown
CVE-2026-75856

9.2CRITICAL

Key Information:

Vendor

Hmbown

Status
Codewhale
Vendor
CVE Published:
18 August 2026

What is CVE-2026-75856?

CodeWhale prior to version 0.8.64 is susceptible to a server-side request forgery (SSRF) bypass due to a flaw in its DNS pinning logic. This vulnerability allows attackers to exploit time-of-check-to-time-of-use (TOCTOU) issues, enabling them to manipulate DNS responses. By doing so, attackers can circumvent initial resolution checks, ultimately leading to the ability to send requests to internal IP addresses and evade SSRF protections. It is crucial for users to update to the latest version to mitigate potential security risks associated with this vulnerability.

Affected Version(s)

CodeWhale 0.8.5 < 0.8.41

CodeWhale 0.8.5 < 0.8.41

CodeWhale 0.8.41 < 0.8.64

References

https://github.com/Hmbown/CodeWhale/security/advisories/G...
vendor-advisory
https://github.com/Hmbown/CodeWhale/commit/26de44a8bd5051...
patch
https://www.vulncheck.com/advisories/codewhale-before-ssr...
third-party-advisory

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

JafarAkhondali
.