CVE-2026-55391: 
Python vulnerability analysis and mitigation

CVE-2026-55391 is an SSRF protection bypass vulnerability in datamodel-code-generator that allows attackers to reach internal network services via DNS rebinding. The tool validates a URL's resolved IP address once during a security check, but then allows httpx to perform an independent DNS resolution at connection time — creating a TOCTOU window that can be exploited. All versions up to and including 0.62.0 are affected; version 0.63.0 contains the fix. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, GitHub Security Advisory). The vulnerability was originally published by the maintainer on June 12, 2026, and added to the GitHub Advisory Database on July 28, 2026.

The root cause is a Time-of-Check Time-of-Use (TOCTOU) race condition (CWE-367) combined with reliance on DNS resolution for a security-critical decision (CWE-350), resulting in Server-Side Request Forgery (CWE-918). In src/datamodel_code_generator/http.py, the get_body() function calls _validate_url_for_fetch(), which resolves the target hostname via socket.getaddrinfo (resolution #1) and rejects private/link-local/reserved addresses. However, the subsequent HTTP connection is made via httpx.get() (resolution #2), which performs its own independent DNS lookup without being pinned to the validated IP. An attacker controlling a low-TTL DNS record can cause the hostname to resolve to a public IP during validation and a private IP (e.g., 127.0.0.1 or 169.254.169.254) during connection, bypassing the allow_private_network=False guard. A self-contained proof-of-concept reproducer is publicly available (Github Advisory, GitHub Security Advisory).

Successful exploitation allows an unauthenticated attacker who can influence a URL fetched by the tool (via a remote $ref in a schema or the --url CLI parameter) to reach internal services that should be inaccessible. Primary consequences include reading cloud instance-metadata credentials from endpoints like 169.254.169.254 (e.g., AWS IMDSv1 tokens), accessing internal-only HTTP services, and performing port/host probing of the internal network. Additionally, the content fetched from the internal target is parsed by the tool and can be reflected into the generated code output, potentially introducing attacker-controlled content into build artifacts. Any CI/CD pipeline or service running datamodel-code-generator against attacker-influenced URLs is within scope (Github Advisory).

1. Register a rebinding domain: Set up an attacker-controlled DNS server for a domain (e.g., rebind.attacker.com) configured with a very low TTL (e.g., 1 second).
2. Configure DNS rebinding: Program the DNS server to return a legitimate public IP address (e.g., 1.2.3.4) for the first query (used during validation) and a private/internal IP (e.g., 127.0.0.1 or 169.254.169.254) for subsequent queries (used during connection).
3. Craft a malicious schema: Create a JSON Schema or OpenAPI document containing a remote $ref pointing to the attacker-controlled hostname: { "$ref": "http://rebind.attacker.com/schema.json" }.
4. Trigger the fetch: Supply the malicious schema to a vulnerable datamodel-code-generator instance, either by passing --url http://rebind.attacker.com/schema.json directly or by providing a schema file containing the remote $ref.
5. Exploit the TOCTOU window: The tool resolves rebind.attacker.com to the public IP during _validate_url_for_fetch() (passes the guard). The DNS TTL expires before httpx.get() makes its connection, and the DNS server now returns the private IP.
6. Reach internal target: httpx connects to the private IP (e.g., http://169.254.169.254/latest/meta-data/iam/security-credentials/), retrieving cloud credentials or internal service data.
7. Harvest reflected output: The fetched internal content is parsed by the tool and may be reflected into the generated code output, exfiltrating data to the attacker (GitHub Security Advisory).

• Network: Outbound DNS queries from the build/CI host to unusual or newly registered low-TTL domains; outbound HTTP connections from the datamodel-code-generator process to 169.254.169.254 or other RFC-1918/loopback addresses; unexpected HTTP requests to cloud metadata endpoints.
• Logs: Tool execution logs showing schema fetches to external hostnames that subsequently resolve to internal IPs; SchemaFetchError absence where one would be expected for private-network URLs; HTTP response content from internal services appearing in generated output files.
• Process: The Python process running datamodel-code-generator making network connections to loopback (127.0.0.1) or link-local (169.254.x.x) addresses, which should not occur under normal operation.
• File System: Generated model files containing unexpected content, strings, or field names that originate from internal service responses rather than the intended schema (GitHub Security Advisory).

The primary remediation is to upgrade datamodel-code-generator to version 0.63.0, which pins the validated DNS result set during the HTTP fetch so the connection is bound to the same IP that passed validation (Release 0.63.0, Patch Commit). As a network-level workaround, implement egress firewall rules to block outbound connections from the tool to RFC-1918, loopback, and link-local address ranges. Additionally, avoid processing untrusted remote $ref URLs or user-supplied --url parameters without additional validation, and consider deploying DNS-level protections such as response policy zones (RPZ) to block DNS rebinding attacks.

The vulnerability was confirmed by the maintainer (koxudaxi) through review and regression testing prior to the 0.63.0 release. The fix was developed via a private fork and merged before public disclosure, following responsible disclosure practices. A Mastodon post from @thehackerwire noted the advisory shortly after publication (Github Advisory). The vulnerability was discovered and reported by security researcher Hamza Haroon (thegr1ffyn), who also provided the public PoC gist.