THREAT OPS › CVEs › CVE-2026-48710
CVE-2026-48710 — Kludex Starlette HTTP Request/Response Smuggling Vulnerability
Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271.
Vulnerability details
- Affected productsStarlette
- KEV remediation due2026-09-16
Related reporting
- CISA Adds Seven Known Exploited Vulnerabilities to Catalogcisa_advisories
- [CISA KEV] CVE-2026-48710 — Kludex Starlette: Kludex Starlette HTTP Request/Response Smuggling Vulnerabilitycisa_kev
- When AI infrastructure becomes the target: Securing gateways and control pointsmsstic
- When AI infrastructure becomes the target: Securing gateways and control pointsmsstic
- LiteLLM Supply Chain Attack: Inside the AI Breach That Exposed 2,500+ Companiessocradar_blog
- [NVD] CVE-2026-48710 (MEDIUM 6.5) — Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` heanvd