6.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-46380

CVE-2026-46380: compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem

A source code audit led to the discovery of three significant security vulnerabilities in the trestle/core/remote/cache.py module.

Finding 1 (Critical): SSRF (CWE-918) The HTTPSFetcher._do_fetch() method passes a user-supplied URL directly to requests.get() without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal services or cloud metadata endpoints (e.g., 169.254.169.254).

Per rule 4.2.11 of the CVE CNA rules Finding 1 will be addressed in this advisory, while findings 2 & 3 will be addressed in separate advisories:

Multiple Path Traversal Vulnerabilities in Remote Fetching Subsystem

Finding 2 & 3 (High/Medium): Path Traversal (CWE-22) The caching logic for HTTPSFetcher and LocalFetcher fails to sanitize URI paths, allowing for arbitrary file reads via file:// or writing cached files outside the intended directory.

Impact: > These vulnerabilities can be chained to exfiltrate sensitive cloud credentials or compromise CI/CD environments.

Reproduction: > Please see the attached poc_ssrf_and_path_traversal.py and terminal_output.txt. 13 exploit vectors have been verified locally.

compliance-trestle_audit_2026-03-30.pdf poc_ssrf_and_path_traversal.py terminal_output.txt

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-46380

CVE-2026-46380:

6.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
compliance-trestle	pip	>= 4.0.0, < 4.0.3	4.0.3
compliance-trestle	pip	< 3.12.2	3.12.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability description explicitly points out an SSRF flaw in trestle/core/remote/cache.py, specifically mentioning the HTTPSFetcher._do_fetch() method. Analysis of the provided patches confirms this. Both commits, 53de5e75332888ea54f5da41d4c7859bb1d608e1 and 5c65c5926fe7ca908b9c1d281f904e7d97ba8310, introduce a new URLSecurityValidator class and apply it within the remote fetcher classes.

The core of the vulnerability lies in the _do_fetch methods of HTTPSFetcher and SFTPFetcher. These methods are responsible for making the actual network connections based on a user-supplied URI. Before the patch, these methods were called without any validation of the target URL, allowing an attacker to specify internal IP addresses or cloud metadata endpoints.

The patch introduces two layers of protection:

Initial Validation: In the __init__ method of both HTTPSFetcher and SFTPFetcher, the validate_url method of the new URLSecurityValidator is called. This performs an initial check on the URL.
Time-of-Check to Time-of-Use (TOCTOU) Mitigation: A second call to validate_url is added at the very beginning of the _do_fetch methods. The comment Re-validate URL before fetch to prevent DNS rebinding attacks makes it clear that this is to prevent attacks where the DNS record for a hostname is changed between the initial validation and the actual connection.

The presence of these added validation calls in the patches is direct evidence that the _do_fetch functions were the points where the unvalidated, user-supplied data was used, making them the vulnerable functions. The advisory focuses on HTTPSFetcher, but the patch correctly identifies and fixes the same flaw in SFTPFetcher. Therefore, both HTTPSFetcher._do_fetch and SFTPFetcher._do_fetch would appear in a runtime profile during exploitation.

Vulnerable functions

HTTPSFetcher._do_fetch

trestle/core/remote/cache.py

The `_do_fetch` method in the `HTTPSFetcher` class was vulnerable to Server-Side Request Forgery (SSRF). Before the patch, it directly used a user-provided URL to make an HTTP request using the `requests` library without proper validation. This allowed an attacker to craft a URL pointing to internal network resources or cloud metadata services, forcing the server to make requests to these sensitive endpoints. The patch mitigates this by adding a call to `self._url_validator.validate_url()` at the beginning of the method to validate the URL against a deny-list of sensitive addresses before making the request.

SFTPFetcher._do_fetch

trestle/core/remote/cache.py

Similar to `HTTPSFetcher`, the `_do_fetch` method in the `SFTPFetcher` class was also vulnerable to Server-Side Request Forgery (SSRF). It used a user-provided URI to establish an SFTP connection without validating the hostname. This could be exploited to make the server connect to arbitrary hosts and ports on the internal network. The patch adds a call to `self._url_validator.validate_url()` to ensure the URI is validated before the connection is attempted, preventing the SSRF vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.