CVE-2026-46380

Published: Aug 14, 2026Modified: Aug 17, 2026

6.7

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Exploitability: 1.5 / Impact: 4.7

Source: security-advisories@github.com (Secondary)

Description

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the HTTPSFetcher._do_fetch() method passes a user-supplied URL directly to requests.get() without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal services or cloud metadata endpoints. Versions 3.12.2 and 4.0.3 fix the issue.

Related CWEs

CWE-918

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (5)

https://github.com/oscal-compass/compliance-trestle/commit/53de5e75332888ea54f5da41d4c7859bb1d608e1

Source: security-advisories@github.com

https://github.com/oscal-compass/compliance-trestle/commit/5c65c5926fe7ca908b9c1d281f904e7d97ba8310

Source: security-advisories@github.com

https://github.com/oscal-compass/compliance-trestle/security/advisories/GHSA-w76h-q7c6-jpjp

Source: security-advisories@github.com

https://github.com/pypa/advisory-database/tree/main/vulns/compliance-trestle/PYSEC-2026-2427.yaml

Source: security-advisories@github.com

https://github.com/oscal-compass/compliance-trestle/security/advisories/GHSA-w76h-q7c6-jpjp

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.