CVE-2026-52776: Compliance-trestle SSRF Vulnerability

CVE-2026-52776 Overview

Compliance-trestle (Trestle) is an open-source tooling platform for managing compliance as code, maintained under the OSCAL Compass project. A server-side request forgery (SSRF) filter bypass affects versions before 3.12.4 and versions 4.0.0 through 4.0.3. The URLSecurityValidator intended to block remote-fetch requests to loopback, link-local, cloud-metadata, and internal network endpoints fails to canonicalize IPv4-mapped IPv6 literals and does not block the unspecified address 0.0.0.0. Attackers who influence an OSCAL artifact fetched by trestle can reach cloud instance-metadata services and internal hosts through the HTTPSFetcher and SFTPFetcher paths. The issue is fixed in versions 3.12.4 and 4.1.0.

Critical Impact
An attacker supplying a malicious OSCAL profile can pivot trestle into internal networks and cloud metadata endpoints, enabling credential theft and lateral movement.

Affected Products

Compliance-trestle versions prior to 3.12.4
Compliance-trestle versions 4.0.0 through 4.0.3
Deployments using HTTPSFetcher or SFTPFetcher remote-fetch paths

Discovery Timeline

2026-08-26 - CVE-2026-52776 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-52776

Vulnerability Analysis

The flaw resides in trestle's URLSecurityValidator, which enforces a blocklist of network destinations before invoking remote-fetch handlers. The validator inspects the parsed host and compares it against known-bad IPv4 ranges, including loopback (127.0.0.0/8), link-local (169.254.0.0/16), and RFC1918 private ranges. This filter is bypassed when a caller supplies an IPv4-mapped IPv6 literal such as [::ffff:169.254.169.254]. Python's ipaddress module parses these values into IPv6Address objects that never match the IPv4 range checks. The unspecified address 0.0.0.0 is likewise omitted from the blocklist, and on Linux and container hosts it routes to services bound to any local interface. This behavior aligns with [CWE-184: Incomplete List of Disallowed Inputs].

Root Cause

The validator's blocklist logic does not canonicalize addresses to a normalized form before comparison. IPv4-mapped IPv6 addresses retain their IPv6 representation and evade IPv4-only membership tests. The blocklist also omits 0.0.0.0, which resolves to local services in most Linux network stacks.

Attack Vector

An attacker who can supply or influence an OSCAL artifact fetched by trestle, such as a malicious profile whose imports reference a bypass URL, triggers the vulnerable fetch path. The HTTPSFetcher and SFTPFetcher then contact attacker-selected internal endpoints. Common targets include the AWS Instance Metadata Service at http://[::ffff:169.254.169.254]/latest/meta-data/, GCP and Azure metadata equivalents, and internal admin interfaces bound to 0.0.0.0.

python

# Patch context from trestle/common/file_utils.py (defense-in-depth hardening)
# Reject absolute paths and traversal sequences
if pathed_name.is_absolute() or name.startswith('/'):
    logger.warning('Task name must not be an absolute path')
    return False

if '..' in pathed_name.parts:
    logger.warning('Task name must not contain ".." path traversal sequences')
    return False

Source: GitHub Commit 5335ff8

Detection Methods for CVE-2026-52776

Indicators of Compromise

Outbound HTTP or SFTP requests from trestle hosts to 169.254.169.254, [::ffff:169.254.169.254], or 0.0.0.0
OSCAL profile documents containing imports entries with IPv6-bracketed hosts or unusual loopback references
Unexpected access to cloud instance-metadata endpoints originating from CI/CD or compliance automation workloads

Detection Strategies

Inspect trestle process network activity for connections to link-local, loopback, and metadata address ranges
Parse ingested OSCAL artifacts for URL fields referencing IPv4-mapped IPv6 literals or the unspecified address
Correlate HTTPSFetcher and SFTPFetcher invocations with destinations outside the expected artifact source allowlist

Monitoring Recommendations

Enable egress logging on hosts running trestle and alert on any traffic to 169.254.0.0/16 or ::ffff:0:0/96 prefixes
Log OSCAL fetch operations with the resolved destination address for post-hoc audit
Monitor cloud audit trails such as AWS CloudTrail for IMDS token requests from non-workload processes

How to Mitigate CVE-2026-52776

Immediate Actions Required

Upgrade compliance-trestle to version 3.12.4 or 4.1.0 immediately
Audit stored OSCAL profiles and catalogs for imports referencing bypass URLs before re-processing
Enforce IMDSv2 with session tokens on AWS workloads that run trestle to reduce impact of SSRF against 169.254.169.254

Patch Information

Maintainers released fixes in 3.12.4 and 4.1.0. The backport to the v3 branch is tracked in GitHub Commit 5335ff8 and the v4 fix in GitHub Commit d107cd1. Full remediation details are documented in GitHub Security Advisory GHSA-h47f-gmjp-m7rr.

Workarounds

Restrict outbound network egress from trestle hosts using firewall rules that deny link-local and loopback ranges for both IPv4 and IPv6
Run trestle inside a network namespace or container with no route to cloud metadata endpoints
Reject OSCAL artifacts from untrusted sources until upgraded versions are deployed

bash

# Upgrade to a patched release
pip install --upgrade 'compliance-trestle>=4.1.0'

# Or for the v3 branch
pip install --upgrade 'compliance-trestle>=3.12.4,<4.0.0'