Dashboard / CVE-2026-48710

CVE-2026-48710

CISA KEV
ACT NOW Priority: 0.00 BB Relevance: 10/100
Published: N/A Modified: N/A First seen: 2026-10-29 Status: pending_score

Description

Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271.

CISA Known Exploited Vulnerability

Vendor / Product Kludex — Starlette
Date Added 2026-09-02
Remediation Due 2026-09-16
This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48710

Weakness Classification (2)

Affected Software (12)

VendorProductVersion
encode starlette 0.8.3 – 1.0.1
redhat ai_inference_server 3.3.0 – 3.3.5
redhat ansible_automation_platform 2.6
redhat ansible_automation_platform 2.7
redhat enterprise_linux_ai 3.0
redhat migration_toolkit_for_applications < 8.2.0
redhat openshift_ai 3.3 – 3.3.5
redhat openshift_ai 3.4 – 3.4.2
redhat openshift_lightspeed -
redhat satellite 6.17
redhat satellite 6.18
redhat satellite 6.19

References & Advisories (29)

https://badhost.org
Mitigation Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2481742
Issue Tracking Third Party Advisory
Showing 25 of 29 references

Bug Bounty Relevance

10 / 100
✓ Known exploited (KEV)
✓ High exploitation probability

CVSS Score

Unscored

EPSS — Exploitation Probability

70.29%
Raw Score 0.702880
Percentile 99.4%
Date 2026-10-28

Intelligence Sources

kev ref →

External Links