CVE-2026-48710

MEDIUMCVSS 6.5Known Exploited

CISA Known Exploited Vulnerability

This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48710

Remediation deadline: September 16, 2026

Description

Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271.

Timeline

Published:May 26th, 2026 10:16 PM

Last modified:September 4th, 2026 3:59 PM

Added to KEV:September 2nd, 2026

CVSS Scoring

CVSS v3: 6.5 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected Software

From NVD CPE configuration data

Vendors

encoderedhat

Products

starletteai_inference_serveransible_automation_platformmigration_toolkit_for_applicationsopenshift_aiopenshift_lightspeedsatelliteenterprise_linux_ai