CVE-2026-46380
compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem
CVSS Score
6.7
EPSS Score
0.0%
EPSS Percentile
0th
compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the HTTPSFetcher._do_fetch() method passes a user-supplied URL directly to requests.get() without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal services or cloud metadata endpoints. Versions 3.12.2 and 4.0.3 fix the issue.
| CWE | CWE-918 |
| Vendor | oscal-compass |
| Product | compliance-trestle |
| Published | Aug 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for oscal-compass compliance-trestle
Be the first to know when new medium vulnerabilities affecting oscal-compass compliance-trestle are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
None
Affected Versions
oscal-compass / compliance-trestle
>= 4.0.0, < 4.0.3 < 3.12.2
References
github.com: https://github.com/oscal-compass/compliance-trestle/security/advisories/GHSA-w76h-q7c6-jpjp github.com: https://github.com/oscal-compass/compliance-trestle/commit/53de5e75332888ea54f5da41d4c7859bb1d608e1 github.com: https://github.com/oscal-compass/compliance-trestle/commit/5c65c5926fe7ca908b9c1d281f904e7d97ba8310 github.com: https://github.com/pypa/advisory-database/tree/main/vulns/compliance-trestle/PYSEC-2026-2427.yaml