Cloudanix VulnDB

CVE-2026-46380

Medium · 6.7

compliance-trestle Vulnerable to SSRF in Remote Fetching Subsystem

CVSS

6.7

EPSS

0.1%

Published

May 28, 2026

CISA due date

—

The record

A source code audit led to the discovery of three significant security vulnerabilities in the trestle/core/remote/cache.py module. **Finding 1 (Critical): SSRF (CWE-918)** The HTTPSFetcher._do_fetch() method passes a user-supplied URL directly to requests.get() without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal services or cloud metadata endpoints (e.g., 169.254.169.254). Per [rule 4.2.11 of the CVE CNA rules](https://www.cve.org/ResourcesSupport/AllResources/CNARules#section_4-2_CVE_ID_Assignment) Finding 1 will be addressed in this advisory, while findings 2 & 3 will be addressed in separate advisories: --- Multiple Path Traversal Vulnerabilities in Remote Fetching Subsystem **Finding 2 & 3 (High/Medium): Path Traversal (CWE-22)** The caching logic for HTTPSFetcher and LocalFetcher fails to sanitize URI paths, allowing for arbitrary file reads via file:// or writing cached files outside the intended directory. Impact: > These vulnerabilities can be chained to exfiltrate sensitive cloud credentials or compromise CI/CD environments. Reproduction: > Please see the attached poc_ssrf_and_path_traversal.py and terminal_output.txt. 13 exploit vectors have been verified locally.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities