CVE-2026-52776 oscal-compass CVE debrief

Who should care

Organizations using Compliance-trestle (Trestle) versions before 3.12.4 or versions 4.0.0 through 4.0.3 should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and updating their deployments to prevent potential server-side request forgery attacks. Security teams and compliance officers should review the CVE record and vendor guidance for affected versions and plan for updates or mitigations through normal change control where exposure is confirmed. Monitoring and detection teams should check relevant logs for exposed assets that need extra review. Asset inventory and vulnerability management teams should track exceptions and retest remediated assets, closing the item only after evidence is documented. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified. Rollback and change window planning should be considered for updates. Source tracking and security-advisory monitoring are recommended to stay informed about the vulnerability and any updates to affected versions or mitigation strategies. Vulnerability management and security teams should prioritize patching to prevent potential server-side request forgery attacks. Compliance and audit teams should ensure that affected deployments are identified and remediated according to organizational policies and regulatory requirements. IT operations and cloud security teams should review and update their configurations to prevent exploitation of this vulnerability. Penetration testing and red teaming teams should consider this vulnerability in their assessments and simulations to identify potential weaknesses in the organization's defenses. Incident response teams should be prepared to respond to potential exploitation of this vulnerability, including detection, containment, and remediation of affected systems. Security awareness and training teams should educate developers and users about the risks associated with this vulnerability and the importance of secure coding practices and secure configuration of Compliance-trestle (Trestle). Business continuity and disaster recovery teams should consider the potential impact of this, and if

Technical summary

The URLSecurityValidator in Compliance-trestle (Trestle) versions before 3.12.4 and versions 4.0.0 through 4.0.3 can be bypassed to reach loopback, link-local, cloud-metadata, and internal network endpoints. This is due to the blocklist not canonicalizing IPv4-mapped IPv6 literals and not blocking the unspecified address 0.0.0.0. An attacker can supply or influence an OSCAL artifact to cause the HTTPSFetcher and SFTPFetcher paths to contact cloud instance-metadata services, loopback interfaces, or internal hosts.

Defensive priority

Organizations using Compliance-trestle (Trestle) versions before 3.12.4 or versions 4.0.0 through 4.0.3 should prioritize patching to prevent potential server-side request forgery attacks.

Recommended defensive actions

• Patch Compliance-trestle (Trestle) to versions 3.12.4 or 4.1.0
• Restrict access to OSCAL artifact imports
• Monitor for suspicious activity on internal networks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The URLSecurityValidator in Compliance-trestle (Trestle) can be bypassed due to improper handling of IPv4-mapped IPv6 literals and the unspecified address 0.0.0.0. This allows an attacker to potentially contact cloud instance-metadata services, loopback interfaces, or internal hosts by supplying a malicious OSCAL artifact. The CVE record was published on 2026-08-26T05:18:10.880Z and has not been modified since then. Evidence is limited to public CVE and NVD details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.