ZeroDayAlert

CVE-2026-48710: Kludex Starlette HTTP Request/Response Smuggling Vulnerability

Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271.

Kludex Starlette Added to KEV 2026-09-02 Federal due 2026-09-16 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

Kludex Starlette is a Python web framework. This vulnerability affects deployments that use Starlette to construct URLs for authentication or request routing decisions, where path-based access controls are in place. The record does not specify which versions are affected or whether patches are available; you will need to check the vendor's security advisory for that detail.

How to check whether this touches you

  • Inventory your applications: does your organisation run or depend on code built with Starlette?
  • Review authentication logic: does your Starlette configuration check the request path to make access-control decisions?
  • Establish network exposure: can the affected application receive requests from untrusted networks (the internet, or networks you do not control)?
  • Determine your running version: check pip show starlette or your container image manifest, and cross-reference against Kludex's security advisory to see whether your version is listed as vulnerable. Version numbers alone are not conclusive—some vendors backport fixes—so also check release notes or advisory timestamps.

What to do

  1. Immediately consult the Kludex security advisory for this CVE to identify affected versions and available mitigations or patches.
  2. If a patch is available and you cannot deploy it within the federal due date (16 September 2026), apply any interim mitigations recommended by the vendor, such as WAF rules or request filtering.
  3. If your application is internet-facing and no mitigation is available, restrict network access to it (IP allowlisting, VPN-only, or disabling the service) until patched.
  4. Enable request logging at the HTTP layer (log the full request URI, host header, and any reconstructed URL used for authentication checks) so you can hunt for exploitation attempts.
  5. If you run a cloud service, follow CISA BOD 26-04 guidance for your cloud provider's patch timelines; if mitigations are not available, plan to discontinue use of the product.

If you find you were exposed

Log entries showing requests with unusual host headers or path prepending in the weeks or months before patching were applied should be reviewed for signs of authentication bypass attempts. Exploitation typically precedes disclosure announcements, so retrospective log analysis across your retention period is necessary. Check whether any successful authentication or access-control decisions were made on requests with suspicious URL reconstruction, and review any sensitive actions taken by those sessions.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-48710 is being exploited. It cannot tell you whether Starlette is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →