CVE-2026-52776: 
Python vulnerability analysis and mitigation

CVE-2026-52776 is a Server-Side Request Forgery (SSRF) vulnerability in the compliance-trestle Python library (pip package compliance-trestle) caused by an incomplete SSRF blocklist in the URLSecurityValidator class. It affects all versions up to and including 4.0.3 (the version that introduced URLSecurityValidator; prior versions had no SSRF guard at all), and is fixed in version 4.1.0. The vulnerability was reported by researcher tonghuaroot, published to the GitHub Advisory Database on August 4, 2026, and reviewed on August 12, 2026. It carries a CVSS v4.0 base score of 8.6 (High) (GitHub Advisory, Security Advisory).

The root cause is an incomplete blocklist (CWE-184) in trestle/core/remote/security.py that enables SSRF (CWE-918) through four distinct bypass vectors. First, IPv4-mapped IPv6 literals such as [::ffff:169.254.169.254], [::ffff:127.0.0.1], and [::ffff:10.0.0.1] are returned by socket.getaddrinfo as IPv6Address objects; Python's ipaddress module silently returns False when checking IPv6Address in IPv4Network(...), so _check_blocked_networks and _check_private_networks never raise an error. Second, the METADATA_HOSTNAMES set uses exact string matching, so the hostname ::ffff:169.254.169.254 (as parsed from a bracketed URL) is not matched. Third, 0.0.0.0 is absent from ALWAYS_BLOCKED_NETWORKS (which only covers 127.0.0.0/8), and on Linux/Docker environments 0.0.0.0 routes to local services on any interface. Fourth, the DNS rebinding check only validates the first getaddrinfo result, though the IPv4-mapped bypass makes rebinding unnecessary. Both HTTPSFetcher and SFTPFetcher share the same vulnerable URLSecurityValidator, so both remote-fetch paths are affected. A proof-of-concept end-to-end reproduction script is included in the advisory (GitHub Advisory, Security Advisory).

Successful exploitation allows an attacker to reach internal endpoints that the URLSecurityValidator was specifically designed to block, including AWS/Azure/GCP/Alibaba Instance Metadata Service (IMDS) endpoints (e.g., https://[::ffff:169.254.169.254]/latest/meta-data/iam/security-credentials/) to exfiltrate short-lived cloud role credentials, loopback administrative interfaces (Docker socket, Prometheus, etcd, Kubelet) via 0.0.0.0 or [::ffff:127.0.0.1], and RFC 1918 internal services even when TRESTLE_BLOCK_PRIVATE_IPS=true is explicitly configured. The confidentiality and integrity of the vulnerable system are rated High, as credential theft can enable lateral movement into cloud infrastructure or internal networks (GitHub Advisory, Security Advisory).

There is no public proof-of-concept exploit code released independently, though the advisory itself contains a detailed end-to-end reproduction script demonstrating all four bypass techniques against compliance-trestle==4.0.3. No in-the-wild exploitation has been reported, and the CVE is not listed in the CISA KEV catalog. The attack requires low privileges — specifically, the ability to supply or influence an OSCAL artifact (profile, catalog, SSP, or component-definition) that compliance-trestle subsequently fetches — and no user interaction. The vulnerability is detectable by Qualys scanners (detection ID 5016879) (GitHub Advisory, Feedly).

1. Identify target: Locate a system running compliance-trestle version 4.0.3 (PyPI) that processes externally-supplied OSCAL profiles, catalogs, SSPs, or component-definitions via trestle import, trestle assemble, trestle author, or similar workflows that resolve remote imports[*].href or back-matter.resources[*].rlinks[*].href references.
2. Craft malicious OSCAL artifact: Create a malicious OSCAL profile JSON/YAML file with one of the bypass URLs in the imports[*].href or back-matter.resources[*].rlinks[*].href field. Example bypass URLs:
   • https://[::ffff:169.254.169.254]/latest/meta-data/iam/security-credentials/admin (cloud IMDS)
   • https://0.0.0.0:PORT/admin (loopback via unspecified address)
   • https://[::ffff:127.0.0.1]:PORT/admin (loopback via IPv4-mapped IPv6)
   • https://[::ffff:10.0.0.1]/internal-api (RFC 1918 bypass)
3. Deliver the artifact: Supply the malicious OSCAL file to the target system through any channel that causes compliance-trestle to process it — e.g., submitting it to a CI/CD pipeline, a compliance automation workflow, or a shared OSCAL repository.
4. Trigger remote fetch: When compliance-trestle processes the artifact, HTTPSFetcher.__init__ or SFTPFetcher.__init__ invokes URLSecurityValidator.validate_url() on the crafted URL. Because the validator does not canonicalize IPv4-mapped IPv6 addresses and does not block 0.0.0.0, the URL passes validation.
5. Receive SSRF response: The requests.get call contacts the internal endpoint. For cloud IMDS, the response contains temporary IAM credentials (AccessKeyId, SecretAccessKey, Token) that are cached and potentially logged or returned to the attacker (GitHub Advisory, Security Advisory).

• Network: Outbound HTTP/HTTPS requests from the compliance-trestle process to 169.254.169.254, [::ffff:169.254.169.254], 0.0.0.0, or [::ffff:127.0.0.1] on any port; unexpected connections to cloud metadata endpoints (AWS: 169.254.169.254, GCP: metadata.google.internal, Azure: 169.254.169.254/metadata.azure.com, Alibaba: 100.100.100.200).
• Logs: Application or HTTP access logs showing requests to /latest/meta-data/iam/security-credentials/ or similar IMDS paths originating from the trestle process; trestle workflow logs showing successful URL validation for IPv6-bracketed addresses like [::ffff:169.254.169.254] or the address 0.0.0.0.
• File System: Unexpected cached files in the trestle cache directory (.trestle/cache/) containing cloud credential JSON responses (fields: AccessKeyId, SecretAccessKey, Token) or internal service responses.
• Process: The trestle Python process making network connections to loopback or link-local addresses; unusual child processes or network activity following trestle import, trestle assemble, or trestle author commands (GitHub Advisory).

Upgrade compliance-trestle to version 4.1.0 or later, which introduces a _canonicalize_ip() method that maps IPv4-mapped IPv6 addresses to their canonical IPv4 form before all network membership checks, adds 0.0.0.0/8 and ::/128 to ALWAYS_BLOCKED_NETWORKS, and canonicalizes bracketed IPv6 literal hostnames in _check_metadata_endpoints. As a network-level workaround, implement egress firewall rules on hosts running compliance-trestle to block outbound connections to 169.254.0.0/16, 127.0.0.0/8, 0.0.0.0/8, and RFC 1918 ranges. Additionally, validate and sanitize all OSCAL artifact sources before processing, and avoid ingesting OSCAL profiles from untrusted external sources (GitHub Advisory, Fix Commit).

The vulnerability was reported by researcher tonghuaroot and published by maintainer degenaro on August 4, 2026, with a patch committed the same day. The advisory notes that the canonicalization fix mirrors patterns adopted by pyca/cryptography, rustls-webpki, and Node.js undici after similar IPv6-mapped SSRF bypasses surfaced in 2024–2025, indicating growing industry awareness of this class of bypass. No significant broader media coverage or social media discussion has been identified (GitHub Advisory).