CVE-2026-46380: oscal-compass compliance-trestle SSRF in remote fetching subsystem

Executive brief

compliance-trestle is a tool used for managing compliance documentation. A security vulnerability in its remote fetching component allows an attacker to trick the application into making unauthorized requests to internal systems or cloud metadata services. This could lead to the exposure of sensitive internal data or cloud credentials, potentially compromising the security of the entire environment.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the trestle/core/remote/cache.py module of compliance-trestle. The HTTPSFetcher._do_fetch() method passes user-supplied URLs directly to the requests.get() function without sufficient validation. An attacker can exploit this to target internal services or cloud metadata endpoints (e.g., 169.254.169.254). Additionally, path traversal vulnerabilities in the caching logic for HTTPSFetcher and LocalFetcher allow for arbitrary file reads via the file:// protocol. These issues can be chained to exfiltrate cloud credentials or compromise CI/CD environments. Patches are available in versions 4.0.3 and 3.12.2.

Affected products

• oscal-compass compliance-trestle >= 4.0.0, < 4.0.3; < 3.12.2

Timeline

• 2026-03-30: other: Source code audit completed
• 2026-05-27: disclosed: Initial publication to repository advisories
• 2026-05-28: advisory: GitHub Advisory published

References

• https://api.github.com/users/yantongggg
• https://github.com/yantongggg
• https://api.github.com/users/yantongggg/gists%7B/gist_id%7D
• https://api.github.com/users/yantongggg/repos
• https://avatars.githubusercontent.com/u/135870728?v=4
• https://api.github.com/users/yantongggg/events%7B/privacy%7D