CVE-2026-46380 oscal-compass CVE debrief

Who should care

Defenders responsible for managing compliance as code, internal services, and cloud metadata endpoints should assess exposure and apply patches or mitigations to prevent exploitation.

Why it matters

CVE-2026-46380 is a Server-Side Request Forgery (SSRF) vulnerability in compliance-trestle that can lead to unauthorized access to internal services or cloud metadata endpoints. Defenders should prioritize verifying exposure and applying patches or mitigations to prevent exploitation.

• Potential unauthorized access to internal services
• Potential unauthorized access to cloud metadata endpoints
• Need to verify exposure and apply patches or mitigations

Technical summary

The HTTPSFetcher._do_fetch() method in compliance-trestle passes a user-supplied URL directly to requests.get() without validation, allowing an attacker to perform SSRF attacks. The fix involves validating user-supplied URLs before passing them to requests.get(). This vulnerability affects compliance-trestle versions prior to 3.12.2 and 4.0.3, and defenders should prioritize verifying exposure of internal services and cloud metadata endpoints, and apply patches or mitigations to prevent exploitation. Additionally, defenders should review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and logs for exposed assets that need extra

Defensive priority

Defenders should prioritize verifying exposure of internal services and cloud metadata endpoints, and apply patches or mitigations to prevent exploitation.

Recommended defensive actions

• Verify exposure of internal services and cloud metadata endpoints
• Apply patches or mitigations to prevent exploitation
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the HTTPSFetcher._do_fetch() method passing a user-supplied URL directly to requests.get() without validation. This allows an attacker to perform SSRF attacks. The fix involves validating user-supplied URLs before passing them to requests.get().

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.