CVE-2026-46380
CVE-2026-46380: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityMedium6.7
Medium [CVE-2026-46380] Server-Side Request Forgery via unvalidated URL in remote fetching subsystem
CVE-2026-46380Source published Source updated
compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the HTTPSFetcher._do_fetch() method passes a user-supplied URL directly to requests.get() without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal services or cloud metadata endpoints. An attacker who can influence a URI that compliance-trestle later resolves (e.g. a href in an OSCAL profile/catalog) can trigger an unvalidated requests.get() call via HTTPSFetcher._do_fetch(), reaching internal-only hosts or cloud metadata endpoints. The response is cached locally and could be exposed if later surfaced. compliance-trestle has no network listener, so exploitation requires a local trestle operation to process attacker-influenced content.…
- Affected products in this advisory
- File Integrity Operator
- Source-reported affected versions
- < 3.12.2
- < 4.0.3
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.