CVE-2026-52776
Description
A flaw was found in compliance-trestle. The URLSecurityValidator, intended to prevent Server-Side Request Forgery (SSRF), contains a bypass vulnerability. This bypass occurs because the validator does not properly handle IPv4-mapped IPv6 addresses or the unspecified address 0.0.0.0. A remote attacker, by providing a specially crafted OSCAL artifact, can force the system to connect to internal network services, cloud instance-metadata services, or local interfaces. This could lead to unauthorized information disclosure or access to internal resources.
Statement
A flaw was found in compliance-trestle. The URLSecurityValidator, which guards trestle's remote-fetch functionality against Server-Side Request Forgery (SSRF), contains a bypass vulnerability. The validator fails to properly canonicalize IPv4-mapped IPv6 addresses (such as ::ffff:169.254.169.254) and does not block the unspecified address 0.0.0.0. This allows an attacker who can supply or influence OSCAL compliance artifacts processed by trestle to bypass security controls and force the system to connect to cloud instance metadata services, loopback interfaces, link-local addresses, or internal network hosts. In OpenShift environments running the File Integrity Operator, this could lead to unauthorized access to cloud credentials and internal resources.
Mitigation
Restrict the source of OSCAL compliance artifacts to trusted, internally-controlled repositories only. Do not configure the File Integrity Operator or other trestle-based tools to fetch compliance profiles from external or untrusted sources. If external compliance frameworks must be imported, review all remote references in OSCAL import statements before processing, and reject any artifacts containing IPv6 addresses, IPv4-mapped IPv6 addresses (::ffff:*), or the address 0.0.0.0 in their href fields.
For cloud deployments, implement network egress controls to block access from pod networks to cloud metadata endpoints (169.254.169.254, fd00:ec2::254) as an additional defense-in-depth measure.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.1 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
