THREAT OPS › Threat News › [GHSA] GHSA-h47f-gmjp-m7rr (high) — compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0
[GHSA] GHSA-h47f-gmjp-m7rr (high) — compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0
GHSA-h47f-gmjp-m7rr Severity: high CVE: CVE-2026-52776
compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0
### Summary
`compliance-trestle` 4.0.3 (latest) ships an `URLSecurityValidator` in `trestle/core/remote/security.py` to block SSRF to loopback / link-local / cloud-metadata endpoints from the HTTPSFetcher and SFTPFetcher remote-fetch paths.
MITRE ATT&CK techniques
Indicators of compromise
- CVE-2026-52776cve
- CVE-2024-4032cve
- https://169.254.169.254:{PORT}/latest/meta-data/url
- https://127.0.0.1:{PORT}/adminurl
- https://metadata.google.internal:{PORT}/url
- https://10.0.0.1:{PORT}/adminurl
- https://0.0.0.0:{PORT}/adminurl
- https://169.254.169.254:18560/latest/meta-data/url
- https://127.0.0.1:18560/adminurl
- https://metadata.google.internal:18560/url
- https://10.0.0.1:18560/adminurl
- https://0.0.0.0:18560/adminurl
- https://0.0.0.0:PORT/`url
- 100.100.100.200ipv4
- 169.254.0.0/16cidr
- 127.0.0.0/8cidr
- 0.0.0.0/8cidr
Original source: https://github.com/advisories/GHSA-h47f-gmjp-m7rr