CVE-2026-45310: CodeWhale: SSRF via HTTP Redirect Bypass in fetch_url Tool

Synopsis

A server-side request forgery (SSRF) vulnerability exists in CodeWhale, the DeepSeek and MiMo coding agent for the terminal, specifically in its fetch_url tool. The tool validates the initial URL against an IP blocklist to block access to internal or cloud-metadata endpoints, but the underlying HTTP client (reqwest) follows up to 5 redirects without re-running that same validation, allowing an attacker to redirect requests to restricted internal addresses. Successful exploitation exposes confidential data such as cloud metadata credentials and internal service responses to the attacker. A patched-image rebuild at version 0.8.22 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the CodeWhale service over the network to supply a crafted URL to the fetch_url tool.

• AuthenticationNot required

  No credentials or account are needed to trigger the vulnerable fetch_url code path.

• Victim interactionRequired

  A user must invoke the fetch_url tool with an attacker-controlled URL, requiring some form of social engineering or malicious input delivery to that user.

• Attack complexityDetail

  Exploitation is reliable and condition-free once a malicious URL is submitted; no race conditions or special memory layout are required.

Blast Radius

• An attacker reads responses from cloud instance metadata endpoints (for example, AWS IMDSv1 at 169.254.169.254), potentially obtaining temporary IAM credentials or instance identity documents.
• Internal HTTP services on private network ranges (RFC 1918 addresses) that are otherwise unreachable from the internet become readable by the attacker through the proxied redirect chain.
• No integrity impact: the vulnerability is limited to read access and does not grant the ability to modify data or execute commands on reachable internal services.
• Service availability is not directly affected; the exploit is a passive information-disclosure technique.