Is CVE-2026-46380 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46380 being exploited in the wild.

How severe is CVE-2026-46380?

Medium severity, with a CVSS score of 6.7, published 28 May 2026.

Which products and versions are affected?

compliance-trestle (PyPI) ECOSYSTEM:introduced=0,fixed=3.12.2,introduced=4.0.0,fixed=4.0.3, ECOSYSTEM:introduced=4.0.0,fixed=4.0.3.

Is there a fix for CVE-2026-46380?

Yes. compliance-trestle (PyPI): upgrade to 4.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46380 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-46380?

Check whether you run compliance-trestle (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46380: oscal-compass compliance-trestle SSRF in remote fetching subsystem

CVE-2026-46380 · Severity: medium · CVSS 6.7 · Published 2026-05-28

compliance-trestle is a tool used for managing compliance documentation. A security vulnerability in its remote fetching component allows an attacker to trick the application into making unauthorized requests to internal systems or cloud metadata services. This could lead to the exposure of sensitive internal data or cloud credentials, potentially compromising the security of the entire environment.

Technologies: compliance-trestle (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-46380 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46380 being exploited in the wild.
How severe is CVE-2026-46380?: Medium severity, with a CVSS score of 6.7, published 28 May 2026.
Which products and versions are affected?: compliance-trestle (PyPI) ECOSYSTEM:introduced=0,fixed=3.12.2,introduced=4.0.0,fixed=4.0.3, ECOSYSTEM:introduced=4.0.0,fixed=4.0.3.
Is there a fix for CVE-2026-46380?: Yes. compliance-trestle (PyPI): upgrade to 4.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46380 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-46380?: Check whether you run compliance-trestle (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

compliance-trestle (PyPI): upgrade to 4.0.3 or later
```
pip install "compliance-trestle>=4.0.3"
```

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the trestle/core/remote/cache.py module of compliance-trestle. The HTTPSFetcher._do_fetch() method passes user-supplied URLs directly to the requests.get() function without sufficient validation. An attacker can exploit this to target internal services or cloud metadata endpoints (e.g., 169.254.169.254). Additionally, path traversal vulnerabilities in the caching logic for HTTPSFetcher and LocalFetcher allow for arbitrary file reads via the file:// protocol. These issues can be chained to exfiltrate cloud credentials or compromise CI/CD environments. Patches are available in versions 4.0.3 and 3.12.2.

Affected products

oscal-compass compliance-trestle >= 4.0.0, < 4.0.3; < 3.12.2

Identifiers

CVE-2026-46380
GHSA-w76h-q7c6-jpjp
PYSEC-2026-2427

Timeline

2026-03-30: other: Source code audit completed
2026-05-27: disclosed: Initial publication to repository advisories
2026-05-28: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.