{"vulnerability": "cve-2026-55391", "sightings": [{"uuid": "5029707d-52e6-4966-8892-a596f36478ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55391", "type": "published-proof-of-concept", "source": "https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-vx7x-vcc2-c44g", "content": "", "creation_timestamp": "2026-07-28T22:35:11.039527Z"}, {"uuid": "7c31a1c9-8f97-4e64-82fb-fde7618a48f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55391", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrqjccj7di2u", "content": "\ud83d\udfe0 CVE-2026-55391 - High (7.5)\n\ndatamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-55391/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-28T23:01:10.834681Z"}, {"uuid": "fe1fd970-6d5c-401b-a854-9d02f5ca08bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55391", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrqmdxhwl22q", "content": "CVE-2026-55391 - datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding\nCVE ID : CVE-2026-55391\n \n Published : July 28, 2026, 10:17 p.m. | 22\u00a0minutes ago\n \n Description : datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, an...", "creation_timestamp": "2026-07-28T23:55:46.995439Z"}, {"uuid": "71f2c40d-6fea-4729-8293-0715dbb3e1eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55391", "type": "seen", "source": "https://gist.github.com/alon710/73a1f99f69f48acfb8cc74440bebaced", "content": "# CVE-2026-55391: CVE-2026-55391: Server-Side Request Forgery Bypass via DNS Rebinding in datamodel-code-generator\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55391\n\n## Summary\nCVE-2026-55391 is a server-side request forgery (SSRF) bypass vulnerability in the datamodel-code-generator package. The vulnerability occurs due to a Time-of-Check to Time-of-Use (TOCTOU) race condition during DNS resolution, combined with a failure to inspect embedded IPv4-in-IPv6 address mappings. By deploying a malicious DNS server with a low Time-To-Live (TTL) configuration, an attacker can bypass private address blocklists and coerce the application to connect to internal services or local endpoints.\n\n## TL;DR\nA Time-of-Check to Time-of-Use (TOCTOU) DNS vulnerability in datamodel-code-generator allows remote attackers to bypass SSRF protections using DNS rebinding or IPv6-mapped IPv4 addresses, exposing internal networks.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918 (SSRF), CWE-367 (TOCTOU)\n- **Attack Vector**: Network\n- **Attack Complexity**: High\n- **CVSS v3.1 Score**: 7.5\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- datamodel-code-generator python package\n- **datamodel-code-generator**: >= 0.50.0, < 0.63.0 (Fixed in: `0.63.0`)\n\n## Mitigation\n\n- Implement DNS pinning at the socket or transport layer to prevent independent DNS resolution passes.\n- Unwrap IPv6-encapsulated IPv4 configurations to detect hidden private addresses.\n- Use isolated container networks with egress rules to block private IP space connections.\n\n**Remediation Steps:**\n1. Update the datamodel-code-generator dependency to version 0.63.0 or greater.\n2. Ensure validation protocols explicitly block legacy IP notations and IPv6 mapping formats.\n3. Configure cloud host firewalls to restrict local loopback and metadata access from worker environments.\n\n## References\n\n- [Fix Commit](https://github.com/koxudaxi/datamodel-code-generator/commit/25c8b7e497419eb20b230fa3318c04f9bebc5a6f)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55391) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T12:32:38.548212Z"}]}