Executive Intelligence Brief
A critical vulnerability (CVE-2026-52776) with a CVSS score of 8.6 was discovered in compliance-trestle, a Python package used for compliance and security. This vulnerability allows for an SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0, potentially leading to unauthorized access to cloud-metadata services, loopback administrative interfaces, or RFC 1918 internal networks. The vulnerability affects compliance-trestle versions <= 4.0.3. Immediate patching or mitigation is recommended to prevent potential exploitation.
Threat Overview
compliance-trestle is a Python package used for compliance and security. It includes a URLSecurityValidator designed to block SSRF attacks to loopback, link-local, and cloud-metadata endpoints. However, the allowlist is incomplete and can be bypassed by four equivalent address representations that resolve to the same blocked host but evade the validator's checks: IPv4-mapped IPv6 literals, IPv4 unspecified address 0.0.0.0, and specific hostname representations.
This vulnerability matters to the broader security landscape because SSRF attacks can lead to unauthorized access to sensitive information, including cloud-metadata services, loopback administrative interfaces, or RFC 1918 internal networks. The bypass can be exploited by a network-position attacker who can supply or influence an OSCAL artifact that compliance-trestle subsequently fetches via HTTPSFetcher or SFTPFetcher.
Technical Deep Dive
Vulnerability Classification
The vulnerability is classified as CWE-918 (Server-Side Request Forgery). This class of vulnerability occurs when an application is tricked into making an unintended request to a different resource, often leading to unauthorized access or data exposure.
The CVSS vector details are not explicitly provided, but the CVSS score is 8.6, indicating a high severity vulnerability.
Root Cause Analysis
The root cause of the vulnerability lies in the URLSecurityValidator implementation in trestle/core/remote/security.py. Specifically, the ALWAYS_BLOCKED_NETWORKS list does not include 0.0.0.0/8, and the validator does not properly handle IPv4-mapped IPv6 addresses. Additionally, the METADATA_HOSTNAMES set is an exact-string set, which does not account for bracketed IPv6 literal hostnames.
Attack Vector & Chain
The attack vector involves a network-position attacker supplying or influencing an OSCAL artifact that compliance-trestle subsequently fetches via HTTPSFetcher or SFTPFetcher. The attacker can reference one of the bypass URLs in imports[*].href or back-matter.resources[*].rlinks[*].href, causing the validator to pass the URL through to requests.get, potentially contacting cloud-metadata services, loopback admin interfaces, or RFC 1918 internal networks.
Exploitation Scenario Walkthrough
Scenario: SSRF Bypass via IPv4-Mapped IPv6 and 0.0.0.0
1. Reconnaissance: The attacker discovers the vulnerable compliance-trestle instance and identifies potential targets for SSRF attacks.
2. Weaponization: The attacker prepares a malicious OSCAL profile referencing a bypass URL (e.g., https://[::ffff:169.254.169.254]/latest/meta-data/iam/security-credentials/admin).
3. Delivery & Exploitation: The attacker supplies the malicious OSCAL profile to the compliance-trestle instance, which fetches the URL via HTTPSFetcher or SFTPFetcher, bypassing the URLSecurityValidator checks.
4. Post-Exploitation: The attacker gains unauthorized access to cloud-metadata services, loopback administrative interfaces, or RFC 1918 internal networks, potentially leading to sensitive information disclosure or further exploitation.
5. Impact Realization: The attacker realizes the impact of the SSRF bypass, which can lead to short-lived role credentials exfiltration, access to local-only admin endpoints, or SSRF to RFC 1918 internal services.
Exploitation in the Wild
There is no indication that this vulnerability is actively exploited in the wild. However, the likelihood of exploitation is high due to the severity of the vulnerability and the potential impact.
Impact Analysis
Direct Impact
The direct impact of this vulnerability includes:
- SSRF to AWS / Azure / GCP / Alibaba IMDS via https://[::ffff:169.254.169.254]/latest/meta-data/iam/security-credentials/
- SSRF to loopback administrative interfaces via https://0.0.0.0:PORT/ or https://[::ffff:127.0.0.1]:PORT/ -> access to local-only admin endpoints (Docker socket on unix://, Prometheus, etcd, Kubelet) that the validator was supposed to deny.
- SSRF to RFC 1918 internal services via https://[::ffff:10.0.0.1]/... even when TRESTLE_BLOCK_PRIVATE_IPS=true is explicitly set, defeating the operator's defense-in-depth posture.
Downstream & Cascading Effects
The downstream and cascading effects of this vulnerability include:
- Supply chain risk: If compliance-trestle is used in a supply chain, the vulnerability could be exploited to gain access to sensitive information or systems.
- Regulatory implications: Depending on the industry and region, the exploitation of this vulnerability could lead to regulatory issues or fines.
- Customer data exposure: If the vulnerable instance is used to process or store customer data, the exploitation of this vulnerability could lead to customer data exposure.
Affected Products & Versions
The affected products and versions are:
- compliance-trestle (PyPI) versions <= 4.0.3
Detection & Threat Hunting
Indicators of Compromise
The indicators of compromise (IoCs) for this vulnerability include:
- IP addresses: 169.254.169.254, 127.0.0.1, 10.0.0.1
- Domains: metadata.google.internal, metadata.azure.com, 100.100.100.200
- File hashes: None
- Registry keys: None
- Mutexes: None
- C2 patterns: None
Detection Rules & Signatures
The detection rules and signatures for this vulnerability include:
- Monitor HTTP and HTTPS traffic for requests to cloud-metadata services, loopback admin interfaces, or RFC 1918 internal networks.
- Monitor OSCAL profile imports and fetching of URLs via HTTPSFetcher or SFTPFetcher.
- Implement network segmentation and access controls to limit the attack surface.
Threat Hunting Queries
The threat hunting queries for this vulnerability include:
- Search for logs related to HTTP and HTTPS traffic to cloud-metadata services, loopback admin interfaces, or RFC 1918 internal networks.
- Search for OSCAL profile imports and fetching of URLs via HTTPSFetcher or SFTPFetcher.
- Search for network connections to suspicious IP addresses or domains.
Remediation & Hardening
Immediate Actions (0-24 hours)
The immediate actions to remediate this vulnerability include:
- Upgrade compliance-trestle to version 4.0.4 or later.
- Implement network segmentation and access controls to limit the attack surface.
- Monitor HTTP and HTTPS traffic for requests to cloud-metadata services, loopback admin interfaces, or RFC 1918 internal networks.
Short-Term Hardening (1-7 days)
The short-term hardening measures for this vulnerability include:
- Implement additional security controls, such as Web Application Firewalls (WAFs) or Intrusion Detection Systems (IDS).
- Conduct regular vulnerability assessments and penetration testing to identify potential vulnerabilities.
Strategic Recommendations
The strategic recommendations for this vulnerability include:
- Implement a robust security program that includes regular vulnerability assessments, penetration testing, and security training for developers and administrators.
- Consider implementing a bug bounty program to identify potential vulnerabilities.
- Continuously monitor and analyze network traffic and system logs to detect potential security incidents.
Analyst Assessment
The analyst assessment of this vulnerability is that it is a critical vulnerability with a high severity score and a high likelihood of exploitation. The vulnerability has a significant impact on the security of compliance-trestle and potentially downstream systems. Immediate patching or mitigation is recommended to prevent potential exploitation.
Sources
- GitHub Security Advisories: https://github.com/advisories/GHSA-h47f-gmjp-m7rr
- CVE-2026-52776: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52776