# CVE-2026-46380: oscal-compass compliance-trestle SSRF in remote fetching subsystem

Source: https://junglewise.ai/threats/cve-2026-46380-oscal-compass-compliance-trestle-ssrf-in-remote-fetching  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-05-28  
License: CC BY 4.0 with a link back

CVE-2026-46380 · Severity: medium · CVSS 6.7 · Published 2026-05-28

compliance-trestle is a tool used for managing compliance documentation. A security vulnerability in its remote fetching component allows an attacker to trick the application into making unauthorized requests to internal systems or cloud metadata services. This could lead to the exposure of sensitive internal data or cloud credentials, potentially compromising the security of the entire environment.

Technologies: [compliance-trestle (PyPI)](https://junglewise.ai/threats/technologies/compliance-trestle). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-46380 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46380 being exploited in the wild.

**How severe is CVE-2026-46380?** Medium severity, with a CVSS score of 6.7, published 28 May 2026.

**Which products and versions are affected?** compliance-trestle (PyPI) ECOSYSTEM:introduced=0,fixed=3.12.2,introduced=4.0.0,fixed=4.0.3, ECOSYSTEM:introduced=4.0.0,fixed=4.0.3.

**Is there a fix for CVE-2026-46380?** Yes. compliance-trestle (PyPI): upgrade to 4.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46380 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-46380?** Check whether you run compliance-trestle (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- compliance-trestle (PyPI): upgrade to 4.0.3 or later

  ```sh
  pip install "compliance-trestle>=4.0.3"
  ```


## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the trestle/core/remote/cache.py module of compliance-trestle. The HTTPSFetcher._do_fetch() method passes user-supplied URLs directly to the requests.get() function without sufficient validation. An attacker can exploit this to target internal services or cloud metadata endpoints (e.g., 169.254.169.254). Additionally, path traversal vulnerabilities in the caching logic for HTTPSFetcher and LocalFetcher allow for arbitrary file reads via the file:// protocol. These issues can be chained to exfiltrate cloud credentials or compromise CI/CD environments. Patches are available in versions 4.0.3 and 3.12.2.

## Affected products

- oscal-compass compliance-trestle >= 4.0.0, < 4.0.3; < 3.12.2

## Identifiers

- CVE-2026-46380
- GHSA-w76h-q7c6-jpjp
- PYSEC-2026-2427

## Timeline

- 2026-03-30: other: Source code audit completed
- 2026-05-27: disclosed: Initial publication to repository advisories
- 2026-05-28: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/yantongggg](https://api.github.com/users/yantongggg)
- [https://github.com/yantongggg](https://github.com/yantongggg)
- [https://api.github.com/users/yantongggg/gists%7B/gist_id%7D](https://api.github.com/users/yantongggg/gists%7B/gist_id%7D)
- [https://api.github.com/users/yantongggg/repos](https://api.github.com/users/yantongggg/repos)
- [https://avatars.githubusercontent.com/u/135870728?v=4](https://avatars.githubusercontent.com/u/135870728?v=4)
- [https://api.github.com/users/yantongggg/events%7B/privacy%7D](https://api.github.com/users/yantongggg/events%7B/privacy%7D)

## Related threats

- [compliance-trestle author generate path traversal file write](https://junglewise.ai/threats/cve-2026-57171-compliance-trestle-author-generate-path-traversal-file-write)
- [Compliance-trestle server-side template injection in Jinja2 tags](https://junglewise.ai/threats/cve-2026-57170-compliance-trestle-server-side-template-injection-in-jinja2-tags)
- [compliance-trestle SSRF allowlist bypass in URLSecurityValidator](https://junglewise.ai/threats/cve-2026-52776-compliance-trestle-ssrf-allowlist-bypass-in-urlsecurityvalidator)
- [oscal-compass compliance-trestle path traversal in jinja command](https://junglewise.ai/threats/cve-2026-46345-oscal-compass-compliance-trestle-path-traversal-in-jinja-command)
- [IBM compliance-trestle path traversal in profile import](https://junglewise.ai/threats/cve-2026-45774-ibm-compliance-trestle-path-traversal-in-profile-import)