CVE-2026-52776
Received Received - Intake

Server-Side Request Forgery in Compliance-Trestle

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: GitHub, Inc.

Description
Compliance-trestle (Trestle) is a tooling platform for managing compliance as code. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the URLSecurityValidator that guards trestle's remote-fetch paths against server-side request forgery can be bypassed to reach loopback, link-local, cloud-metadata, and internal network endpoints it was designed to block. The blocklist does not canonicalize IPv4-mapped IPv6 literals such as [::ffff:169.254.169.254], which resolve to IPv6Address objects that never match the blocked IPv4 ranges, and it does not block the unspecified address 0.0.0.0, which routes to local services on Linux and inside containers. An attacker who can supply or influence an OSCAL artifact that trestle fetches, such as a malicious profile whose imports reference one of these bypass URLs, can cause the HTTPSFetcher and SFTPFetcher paths to contact cloud instance-metadata services, loopback interfaces, or internal hosts. This issue is fixed in versions 3.12.4 and 4.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-52776

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
trestle compliance-trestle to 4.0.3 (inc)
trestle compliance-trestle 3.12.4
trestle compliance-trestle 4.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-184 The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-52776 is a Server-Side Request Forgery (SSRF) vulnerability in compliance-trestle versions before 3.12.4 and 4.0.0 through 4.0.3. The URLSecurityValidator fails to block certain IPv4-mapped IPv6 addresses and the unspecified address 0.0.0.0, allowing attackers to bypass SSRF protections and access internal or cloud-metadata endpoints.

Detection Guidance

To detect this vulnerability, check compliance-trestle versions before 3.12.4 or 4.0.0-4.0.3. Use commands like 'pip show compliance-trestle' to verify installed versions. Monitor network logs for outbound connections to loopback, link-local, or cloud-metadata endpoints from trestle processes.

Impact Analysis

An attacker could exploit this to access cloud instance-metadata services, loopback interfaces, or internal networks by crafting malicious OSCAL artifacts. This may lead to credential theft, unauthorized access to admin interfaces, or data exfiltration from internal services.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating confidentiality requirements in GDPR and HIPAA. Compliance with these regulations may be compromised if sensitive data is exposed due to the SSRF flaw.

Mitigation Strategies

Upgrade compliance-trestle to versions 3.12.4 or 4.1.0 or later. Ensure URLSecurityValidator blocks IPv4-mapped IPv6 addresses and 0.0.0.0. Review OSCAL artifacts for malicious URLs in imports or resources. Disable unnecessary network access for trestle processes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52776. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart