CVE-2026-55391 Overview
CVE-2026-55391 is a DNS rebinding vulnerability in datamodel-code-generator, a Python tool that generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Versions prior to 0.63.0 validate a URL host once but then allow httpx to resolve the host again during the actual connection. This time-of-check to time-of-use gap enables attackers to bypass the allow_private_network=False control and reach internal services. The issue is tracked under [CWE-350] (Reliance on Reverse DNS Resolution for a Security-Critical Action).
Critical Impact
Attackers can bypass server-side request forgery (SSRF) protections and interact with internal network services from systems running vulnerable versions of datamodel-code-generator.
Affected Products
- datamodel-code-generator versions prior to 0.63.0
- Python applications and pipelines that fetch remote schemas using the library
- CI/CD systems that generate models from URL-supplied schema sources
Discovery Timeline
- 2026-07-28 - CVE-2026-55391 published to NVD
- 2026-07-29 - Last updated in NVD database
Technical Details for CVE-2026-55391
Vulnerability Analysis
The vulnerability resides in src/datamodel_code_generator/http.py. The code path through get_body, _validate_url_for_fetch, and _get_ips_from_host resolves the target hostname and confirms it does not point to a private network address. After this validation succeeds, control passes to httpx, which performs an independent DNS lookup when opening the connection.
An attacker controlling an authoritative DNS server can return a public IP address for the first lookup and a private or loopback address (for example, 127.0.0.1, 169.254.169.254, or 10.0.0.0/8 hosts) for the second. The security check therefore validates one address while the request targets another. This defeats the allow_private_network=False guard and enables SSRF against internal services, including cloud metadata endpoints and unauthenticated internal APIs.
Root Cause
The root cause is a time-of-check to time-of-use (TOCTOU) flaw between hostname validation and hostname resolution. datamodel-code-generator performs its own IP allowlisting on a resolved address, but httpx re-resolves the host at connection time rather than reusing the validated IP. Any attacker who controls the DNS response for a hostname can serve different answers on subsequent queries and reach hosts the validator would have rejected.
Attack Vector
Exploitation requires that an application call datamodel-code-generator with an attacker-influenced URL and rely on the built-in private network restriction. The attacker registers a domain pointing to a DNS server with a very short TTL, returns a public IP for the initial _get_ips_from_host check, then rebinds the record to an internal address before httpx reconnects. The high attack complexity reflects the need to control DNS responses and race the two resolution steps. Successful exploitation grants read access to internal HTTP services reachable from the host running the code generator.
No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-vx7x-vcc2-c44g and the GitHub Gist Analysis for a full technical breakdown.
Detection Methods for CVE-2026-55391
Indicators of Compromise
- Outbound DNS queries from build or automation hosts to unfamiliar domains with very low TTL values (often under 5 seconds).
- Repeated resolutions of the same hostname producing different IP addresses within a short window, one public and one RFC1918 or loopback.
- Requests from datamodel-code-generator processes to internal endpoints such as 169.254.169.254, 127.0.0.1, or private subnets.
Detection Strategies
- Inventory Python dependencies across build servers and developer workstations to identify installations of datamodel-code-generator below version 0.63.0.
- Correlate process telemetry with network telemetry to flag Python interpreters that resolve a hostname externally and then connect to a private IP.
- Alert on any HTTP request originating from schema-generation tooling that targets cloud instance metadata services.
Monitoring Recommendations
- Log DNS resolutions and outbound connections from CI/CD workers and record both the queried name and the connected IP for later correlation.
- Monitor egress firewall denies for build systems attempting to reach internal ranges after resolving external names.
- Track invocations of the datamodel-codegen CLI and library entry points against a baseline of expected schema sources.
How to Mitigate CVE-2026-55391
Immediate Actions Required
- Upgrade datamodel-code-generator to version 0.63.0 or later across all environments, including CI/CD runners and container images.
- Restrict egress from systems that run the code generator so they cannot reach cloud metadata services or internal management interfaces.
- Treat any URL provided to schema generation as untrusted input and validate it against a strict allowlist of external hosts.
Patch Information
The maintainers fixed the issue in version 0.63.0. See the GitHub Release v0.63.0 and the remediation commit 25c8b7e for the changes that pin the resolved IP through the request lifecycle.
Workarounds
- Route requests from the code generator through a forward proxy that enforces its own destination allowlist and blocks private ranges.
- Run schema generation inside a network namespace or container that has no route to internal subnets or the metadata endpoint.
- Disable URL-based schema fetching and pass schemas only from local files that have been reviewed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
