{"id":"CVE-2026-46380","aliases":["GHSA-w76h-q7c6-jpjp","PYSEC-2026-2427"],"url":"https://o3.security/vulnerability/CVE-2026-46380","summary":"compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem","details":"compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the HTTPSFetcher._do_fetch() method passes a user-supplied URL directly to requests.get() without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal services or cloud metadata endpoints. Versions 3.12.2 and 4.0.3 fix the issue.","published":"2026-08-14T16:10:14.408Z","modified":"2026-08-19T03:31:05.995562561Z","cvss":{"score":6.7,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N"},"epss":{"score":0.001,"percentile":0.01002,"asOf":"2026-08-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"compliance-trestle","fixedVersion":"4.0.3"},{"ecosystem":"PyPI","name":"compliance-trestle","fixedVersion":"3.12.2"}],"fix":{"url":"https://github.com/oscal-compass/compliance-trestle/commit/53de5e75332888ea54f5da41d4c7859bb1d608e1","label":"oscal-compass/compliance-trestle@53de5e7"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46380.json"},{"type":"ADVISORY","url":"https://github.com/oscal-compass/compliance-trestle/security/advisories/GHSA-w76h-q7c6-jpjp"},{"type":"ADVISORY","url":"https://github.com/pypa/advisory-database/tree/main/vulns/compliance-trestle/PYSEC-2026-2427.yaml"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46380"},{"type":"FIX","url":"https://github.com/oscal-compass/compliance-trestle/commit/53de5e75332888ea54f5da41d4c7859bb1d608e1"},{"type":"FIX","url":"https://github.com/oscal-compass/compliance-trestle/commit/5c65c5926fe7ca908b9c1d281f904e7d97ba8310"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-19T03:31:05.995562561Z"}}