External risk intelligence

CodeWhale DNS Pinning SSRF Bypass Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-75856

The vulnerability exists in CodeWhale, a library or service that processes external requests and performs DNS lookups. Because such services are commonly deployed as web-facing components or API gateways that interact with untrusted external inputs, the vulnerable code path is commonly exposed to the public internet.

Server-Side Request Forgery

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability impacts CodeWhale, a technology that handles DNS resolution and server-side requests. It could allow unauthorized access to internal systems by manipulating DNS responses, potentially bypassing existing security measures. The primary concern is confirming if our environment utilizes this specific technology and is exposed to this risk.

A bypass allows unauthorized internal access.
Affects systems processing external requests.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted DNS responses to a vulnerable CodeWhale instance. This manipulation, which bypasses initial DNS resolution checks by exploiting a time-of-check to time-of-use flaw, allows the attacker to trick the server into making requests to internal network resources, bypassing security mitigations.

Public network access required.
Manipulated DNS responses trigger vulnerability.
Internal network access and data exposure.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in CodeWhale could allow an attacker to bypass server-side request forgery (SSRF) mitigations by manipulating DNS responses. When supported, this could lead to the application making requests to unintended internal IP addresses, potentially exposing sensitive information or system behavior.

Internal network access and service behavior.
Manipulated DNS responses can bypass defenses.
Unauthorized access to internal network resources.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in CodeWhale's DNS pinning logic could allow attackers to bypass SSRF mitigations and target internal IP addresses. Owners of applications or services utilizing CodeWhale should first identify all deployments, confirm their exposure and criticality, and then engage the appropriate teams for remediation planning.

Application owners and platform teams should investigate.
Verify CodeWhale instances and external reachability.
Plan remediation based on confirmed exposure and risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is CodeWhale?

CodeWhale is a specialized component or library designed to handle DNS resolution and manage server-side requests. It acts as an intermediary that retrieves data or interacts with external resources on behalf of an application. Developers often integrate this technology into systems that require automated network communication, such as API gateways or services that need to fetch content from the internet while managing connectivity risks.

How does CVE-2026-75856 cause an SSRF bypass?

This vulnerability is classified as Server-Side Request Forgery (SSCW-918). It involves a time-of-check to time-of-use flaw within the DNS pinning logic. Essentially, the software performs a security check on a domain name, but the underlying system can be tricked by changing the DNS response immediately after that check. This allows the application to be manipulated into sending requests to internal IP addresses that were supposed to be blocked.

Do I need a custom DNS server to trigger this?

An attacker needs the ability to influence DNS resolution to take advantage of this time-of-check to time-of-use flaw. The vulnerability does not trigger if the CodeWhale instance is not processing untrusted input that influences the DNS resolution path. Simply using the software in a configuration where DNS responses are static or reliably controlled by an internal, trusted resolver avoids this specific manipulation path.

Why is my CodeWhale instance considered high risk?

Halo Surface Signal indicates that because CodeWhale is designed to process external requests, it is frequently deployed in internet-facing roles. When a service is reachable from the public internet and handles untrusted inputs, it is significantly more likely to encounter the malicious DNS responses required to trigger this vulnerability. If your instance is exposed to the internet, the potential for unauthorized access to your internal network increases.

What is the first step for responding to this CVE?

The immediate priority is to identify all instances of CodeWhale running within your infrastructure. Once you have a list of deployments, determine which ones are accessible from the internet or handle requests from untrusted sources. After confirming your exposure, prioritize these systems for remediation planning and coordinate with your platform or engineering teams to ensure the environment is secured against unauthorized internal requests.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.