CVE-2026-52776

A flaw was found in compliance-trestle. The URLSecurityValidator, intended to prevent Server-Side Request Forgery SSRF, contains a bypass vulnerability. This bypass occurs because the validator does not properly handle IPv4-mapped IPv6 addresses or the unspecified address 0.0.0.0. A remote...

CVE-2026-52776 Trestle URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0

Compliance-trestle Trestle is a tooling platform for managing compliance as code. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the URLSecurityValidator that guards trestle's remote-fetch paths against server-side request forgery can be bypassed to reach loopback, link-local,...

CVE-2026-52776 Trestle URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0

Compliance-trestle Trestle is a tooling platform for managing compliance as code. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the URLSecurityValidator that guards trestle's remote-fetch paths against server-side request forgery can be bypassed to reach loopback, link-local,...

CVE-2026-52776

compliance-trestle (Trestle), a Python tooling platform for managing compliance-as-code via OSCAL, contains an SSRF bypass in its URLSecurityValidator (trestle/core/remote/security.py). The validator fails to canonicalize IPv4-mapped IPv6 literals (e.g., [::ffff:169.254.169.254]) before network m...

GHSA-H47F-GMJP-M7RR compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0

Summary compliance-trestle 4.0.3 latest ships an URLSecurityValidator in trestle/core/remote/security.py to block SSRF to loopback / link-local / cloud-metadata endpoints from the HTTPSFetcher and SFTPFetcher remote-fetch paths. The allowlist is incomplete and can be bypassed by four equivalent...