CVE-2026-75856 CodeWhale before 0.8.64 SSRF Bypass via DNS Pinning TOCTOU
Attackers can bypass SSRF protections via DNS pinning TOCTOU flaws to access internal network resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-75856?
CVE-2026-75856 is a critical server-side request forgery vulnerability in Hmbown CodeWhale, published on 18 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacks. Attackers can manipulate DNS responses to fail initial resolution checks and succeed on secondary requests, allowing requests to internal IP addresses and bypassing SSRF mitigations.
Weakness: CWE-918
Which versions are affected by CVE-2026-75856?
8 open source packages ship an affected version, including codewhale-tui, deepseek-tui and codewhale.
| Package | Affected | Fixed in |
|---|---|---|
codewhale-tui crates.io | From 0.8.41 | 0.8.64 |
codewhale-tui crates.io | From 0.8.41 | 0.8.64 |
deepseek-tui crates.io | From 0.8.5 to 0.8.41 | None |
deepseek-tui crates.io | From 0.8.5 to 0.8.41 | None |
codewhale npm | From 0.8.41 | 0.8.64 |
codewhale npm | From 0.8.41 | 0.8.64 |
2 more packages
deepseek-tui npm | From 0.8.5 | 0.8.41 |
deepseek-tui npm | From 0.8.5 | 0.8.41 |
How do I fix CVE-2026-75856?
Upgrade codewhale-tui to 0.8.64 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-75856 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-75856 exists.
Sources
Also known as GHSA-6v2g-fpxh-pmmh.