CVE-2026-75856

creationtimestamp| type| source ---|---|--- 2026-08-18 18:09:49+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtessolmhk2f 2026-08-18 18:20:11+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtetezieuk2m 2026-09-04 20:35:09+00:00| published-proof-of-concept|...

CVE-2026-75856

CodeWhale (before 0.8.64) has a TOCTOU flaw in its DNS-pinning SSRF mitigation: an attacker manipulates DNS so the initial resolution check fails, but a subsequent request resolves to an internal IP. This allows unauthenticated, network-accessible requests to internal services, exposing sensitive...

CVE-2026-75856 CodeWhale before 0.8.64 SSRF Bypass via DNS Pinning TOCTOU

CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacks. Attackers can manipulate DNS responses to fail initial resolution checks and succeed on secondary requests, allowing requests to intern...