CVE-2026-75856 Overview
CVE-2026-75856 is a server-side request forgery (SSRF) bypass vulnerability in CodeWhale versions before 0.8.64. The flaw resides in the DNS pinning logic used to validate outbound fetch_url requests. The validation performs a time-of-check-time-of-use (TOCTOU) operation that allows attackers to manipulate DNS responses so that initial resolution checks fail while subsequent HTTP requests succeed. This lets attackers reach internal IP addresses that SSRF mitigations were intended to block. The weakness is classified as [CWE-918].
Critical Impact
Unauthenticated attackers can bypass SSRF protections over the network without user interaction, enabling access to internal services and confidential data.
Affected Products
- CodeWhale versions prior to 0.8.64
- CodeWhale TUI fetch_url tool component
- CodeWhale local tool trust boundary components
Discovery Timeline
- 2026-08-18 - CVE-2026-75856 published to NVD
- 2026-08-18 - Last updated in NVD database
Technical Details for CVE-2026-75856
Vulnerability Analysis
The vulnerability affects the fetch_url tool implemented in crates/tui/src/tools/fetch_url.rs. Before the fix, DNS resolution failure was treated as a soft error. The code would allow the HTTP request to proceed and fail naturally when tokio::net::lookup_host returned an error. An attacker controlling an authoritative DNS server could return SERVFAIL or similar failures on the first lookup performed during validation. The reqwest HTTP client would then perform a second, independent DNS lookup for the same host. That second lookup could return an internal IP address such as 169.254.169.254 or 127.0.0.1, bypassing pinning entirely.
Root Cause
The root cause is a TOCTOU race between the validation lookup and the HTTP client lookup. The validated IP address was not reused for the actual request. When validation encountered a resolution error, the code silently permitted the request instead of denying it, breaking the intended SSRF fail-closed semantics.
Attack Vector
An attacker hosts an authoritative DNS server for a domain they control. When CodeWhale invokes fetch_url against that domain, the attacker's DNS server responds inconsistently across queries. The initial validation query returns an error or public IP, and the subsequent HTTP client query returns a private IP address such as an AWS instance metadata endpoint. The attack requires no authentication and no user interaction.
return Ok(None);
}
+ let addrs = tokio::net::lookup_host((host.as_str(), 0u16))
+ .await
+ .map_err(|e| {
+ ToolError::permission_denied(format!(
+ "could not resolve host before fetch_url request: {e}"
+ ))
+ })?;
let mut first_valid: Option<std::net::IpAddr> = None;
- if let Ok(addrs) = tokio::net::lookup_host((host.as_str(), 0u16)).await {
- for addr in addrs {
- validate_dns_resolved_ip(&host, &addr.ip(), context.network_policy.as_ref())?;
- if first_valid.is_none() {
- first_valid = Some(addr.ip());
- }
+ for addr in addrs {
+ validate_dns_resolved_ip(&host, &addr.ip(), context.network_policy.as_ref())?;
+ if first_valid.is_none() {
+ first_valid = Some(addr.ip());
}
}
- // If DNS resolution fails, let the HTTP request proceed and fail naturally.
- Ok(first_valid.map(|validated_ip| (host, validated_ip)))
+ let Some(validated_ip) = first_valid else {
+ return Err(ToolError::permission_denied(
+ "host resolved to no addresses before fetch_url request",
+ ));
Source: GitHub CodeWhale Commit
The patch converts DNS lookup failure into a hard permission_denied error and ensures validation cannot silently pass with no resolved addresses.
Detection Methods for CVE-2026-75856
Indicators of Compromise
- Outbound fetch_url requests from CodeWhale that resolve to RFC1918 addresses, link-local 169.254.0.0/16, or loopback ranges.
- DNS query patterns showing multiple lookups for the same host with divergent A record responses within a short window.
- HTTP responses from cloud metadata endpoints such as http://169.254.169.254/latest/meta-data/ correlating with CodeWhale activity.
Detection Strategies
- Inspect CodeWhale process telemetry for fetch_url invocations targeting attacker-controlled domains followed by internal network connections.
- Correlate DNS resolver logs with process network activity to identify TOCTOU response inconsistencies.
- Alert on CodeWhale versions below 0.8.64 reported by software inventory scans.
Monitoring Recommendations
- Enable outbound DNS logging on hosts running CodeWhale and forward events to a central analytics platform.
- Monitor egress traffic from developer workstations for connections to cloud metadata IPs.
- Track any new outbound HTTP requests originating from CodeWhale toolchain processes.
How to Mitigate CVE-2026-75856
Immediate Actions Required
- Upgrade CodeWhale to version 0.8.64 or later on all systems where the TUI is installed.
- Audit recent fetch_url activity for requests to internal or metadata IP ranges.
- Rotate any credentials that may have been exposed via cloud metadata endpoints if exploitation is suspected.
Patch Information
The fix is committed in the CodeWhale repository as commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e. The patch hardens fetch_url by returning permission_denied on any DNS resolution failure and requires at least one validated address before the request proceeds. Details are available in the GitHub Security Advisory GHSA-6v2g-fpxh-pmmh and the VulnCheck SSRF Bypass Advisory.
Workarounds
- Restrict outbound network access from hosts running CodeWhale using egress firewall rules that deny RFC1918 and link-local destinations.
- Block DNS resolution of external hostnames to private IP ranges using DNS filtering to prevent rebinding-style attacks.
- Disable or gate the fetch_url tool through network policy configuration until systems are patched.
# Example egress rule to block link-local metadata access from CodeWhale hosts
iptables -A OUTPUT -d 169.254.169.254/32 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner codewhale -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner codewhale -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner codewhale -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
