Is CVE-2026-46380 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-46380?

CVE-2026-46380 has a CVSS v3 severity of MEDIUM (6.7).

Back

CVE-2026-46380

Description

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the HTTPSFetcher._do_fetch() method passes a user-supplied URL directly to requests.get() without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal services or cloud metadata endpoints. Versions 3.12.2 and 4.0.3 fix the issue.