Server-side Request Forgery (SSRF) Affecting compliance-trestle package, versions [,4.1.0)
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-COMPLIANCETRESTLE-18912944
- published18 Aug 2026
- disclosed12 Aug 2026
- credittonghuaroot (童话)
Introduced: 12 Aug 2026
NewCVE-2026-52776 (opens in a new tab)How to fix?
Upgrade compliance-trestle to version 4.1.0 or higher.
Overview
compliance-trestle is a Tools to manage & autogenerate python objects representing the OSCAL layers/models
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the validate_url function in trestle/core/remote/security.py via IPv4-mapped IPv6 addresses and unspecified network ranges that bypass the URL blocklist. An attacker who can supply a URL to be fetched (e.g., [::ffff:169.254.169.254] or 0.0.0.0) can cause the application to reach internal metadata endpoints or loopback addresses that should be blocked, enabling SSRF attacks against cloud instance metadata services or other internal resources.