{"id":"CVE-2026-46380","title":"compliance-trestle is a tooling platform for managing compliance as code","summary":"compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the HTTPSFetcher._do_fetch() method passes a user-supplied URL directly to requests.get() without validation. This allows an at…","severity":"medium","cvss":6.7,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","cwe":["CWE-918"],"vendor":"compliance-trestle","product":"compliance-trestle","affected":["compliance-trestle >= 4.0.0, < 4.0.3","compliance-trestle < 3.12.2"],"patched":["compliance-trestle 4.0.3","compliance-trestle 3.12.2"],"published":"2026-08-14","updated":"2026-09-18","sourceUpdated":"2026-09-18T20:09:01.757","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-46380","references":[{"url":"https://github.com/oscal-compass/compliance-trestle/commit/53de5e75332888ea54f5da41d4c7859bb1d608e1","label":"security-advisories@github.com"},{"url":"https://github.com/oscal-compass/compliance-trestle/commit/5c65c5926fe7ca908b9c1d281f904e7d97ba8310","label":"security-advisories@github.com"},{"url":"https://github.com/oscal-compass/compliance-trestle/security/advisories/GHSA-w76h-q7c6-jpjp","label":"security-advisories@github.com"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/compliance-trestle/PYSEC-2026-2427.yaml","label":"security-advisories@github.com"},{"url":"https://github.com/oscal-compass/compliance-trestle/security/advisories/GHSA-w76h-q7c6-jpjp","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/oscal-compass/compliance-trestle"}],"tags":["nvd","osv","pip"],"epss":0.00156,"epssPercentile":0.05198,"aliases":["GHSA-w76h-q7c6-jpjp","PYSEC-2026-2427"],"ecosystem":"pip","ingestedAt":"2026-07-13T18:58:04.176Z","slug":"CVE-2026-46380","body":"## Overview\n\ncompliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the HTTPSFetcher._do_fetch() method passes a user-supplied URL directly to requests.get() without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal services or cloud metadata endpoints. Versions 3.12.2 and 4.0.3 fix the issue.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-46380)\n\nAffected packages:\n\n- `compliance-trestle >= 4.0.0, < 4.0.3`\n- `compliance-trestle < 3.12.2`\n\nPatched in:\n\n- `compliance-trestle 4.0.3`\n- `compliance-trestle 3.12.2`\n\nSource: https://osv.dev/vulnerability/GHSA-w76h-q7c6-jpjp","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":36.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}