CVE-2026-52776

A flaw was found in compliance-trestle. The URLSecurityValidator, intended to prevent Server-Side Request Forgery SSRF, contains a bypass vulnerability. This bypass occurs because the validator does not properly handle IPv4-mapped IPv6 addresses or the unspecified address 0.0.0.0. A remote...

GHSA-H47F-GMJP-M7RR compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0

Summary compliance-trestle 4.0.3 latest ships an URLSecurityValidator in trestle/core/remote/security.py to block SSRF to loopback / link-local / cloud-metadata endpoints from the HTTPSFetcher and SFTPFetcher remote-fetch paths. The allowlist is incomplete and can be bypassed by four equivalent...