CVE-2026-75856

Name of the Vulnerable Software and Affected Versions CodeWhale versions prior to 0.8.64

Description A server-side request forgery (SSRF) bypass exists in the DNS pinning logic. The issue stems from a failure to prevent time-of-check-time-of-use (TOCTOU) attacks, where a race condition occurs between the time a security check is performed and the time the resource is actually used. Attackers can manipulate DNS responses to fail initial resolution checks and succeed on secondary requests, enabling unauthorized requests to internal IP addresses and bypassing SSRF mitigations.

Recommendations Update CodeWhale to version 0.8.64 or later.