CodeWhale versions before 0.8.26 contain an SSRF vulnerability (CWE-918) where SSRF protections that validate hostnames resolving to private IPv6 addresses can be bypassed by directly using the IPv6 URL format http://[::1]. This bypass allows attackers to make the server perform unintended requests to internal IPv6 addresses. The vulnerability is fixed in version 0.8.26. The CVSS 3.1 base score is 7.4, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, high confidentiality impact, and no integrity or availability impact.

Successful exploitation could allow an attacker to cause the vulnerable server to make unauthorized requests to internal IPv6 addresses, potentially exposing sensitive information or internal services. The confidentiality impact is high, but integrity and availability are not affected. No known active exploits have been reported.

Upgrade CodeWhale to version 0.8.26 or later, where this SSRF vulnerability is fixed. Since the vendor advisory indicates the issue is resolved in 0.8.26, applying this official fix is the recommended remediation. Patch status is confirmed by the vendor's versioning information. No additional mitigation steps are specified.