NetSight
IP …
medium6.5Known exploited

CVE-2026-48710

Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

Exploited in the wild

This vulnerability is on the CISA Known Exploited Vulnerabilities list, added 2026-09-02. Federal due date: 2026-09-16.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Impact

Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271.

Affected packages

EcosystemPackageAffectedFixed in
pipstarlette<= 1.0.01.0.1

Affected products

VendorProductAffected versions
EncodeStarlette
before 1.0.1
from 0.8.3 before 1.0.1
RedhatAi Inference Server
from 3.3.0 through 3.3.5
RedhatAnsible Automation Platform
Versions 2.6, 2.7
RedhatMigration Toolkit For Applications
before 8.2.0
RedhatOpenshift Ai
from 3.3 before 3.3.5
from 3.4 before 3.4.2
RedhatOpenshift Lightspeed
All versions
RedhatSatellite
Versions 6.17, 6.18, 6.19
RedhatEnterprise Linux Ai
Version 3.0

Weakness classification

CWE-444CWE-1289

References