CVE-2026-48710 — Kludex Starlette: Kludex Starlette HTTP Request/Response Smuggling Vulnerability

1. Executive summary

CVE-2026-48710 is an HTTP request/response smuggling vulnerability in Kludex Starlette (CVSS 6.5, MEDIUM) that allows an attacker to inject paths into the host portion of a request, prepending the actual path so that the reconstructed URL differs from what the application expects. The practical impact is authentication bypass where authorisation decisions depend on the reconstructed URL path. The flaw is listed in CISA KEV (added 2026-09-02, remediation due 2026-09-16) with an EPSS of 2%, and the source explicitly notes it can be chained with CVE-2026-42271 (CVSS 8.7, HIGH, in KEV since 2026-06-08, EPSS 84%) — a command injection flaw in the same ecosystem whose exploitation likelihood is materially higher. For EMEA financial services running Starlette-backed Python services (including anything built on FastAPI, which sits on Starlette), the risk is unauthenticated path-dependent authorisation bypass on internet-facing endpoints, with a credible escalation path to command execution via the chained CVE.

2. Regulatory framing

No NIS2 or UK NIS article is directly engaged beyond generic patching duties; the triggers here are not distinctive to those regimes' scopes.

3. Technical analysis & attack chain

Vulnerability mechanism (confirmed from NVD/CISA source)

1. Component: Kludex Starlette — the ASGI web framework for Python, the underlying framework of FastAPI. Any Starlette-based service that reconstructs request URLs and bases authentication or authorisation decisions on the reconstructed path is in scope.
2. Flaw class: CWE-444 (HTTP Request Smuggling) / CWE-1289 (per the verified NVD classification). The vulnerability permits an attacker to inject path components into the host part of the request; the injected path is prepended to the actual request path during URL reconstruction.
3. Effect: The application's reconstructed URL path no longer matches the path the routing/auth layer believes it is authorising. Where authentication depends on the reconstructed URL's path — for example, middleware that permits unauthenticated access to certain path prefixes, or path-based ACLs in front of protected routes — an attacker can craft a request whose reconstructed path lands in an allowed segment while the effective request targets a protected resource. Result: authentication bypass without credentials.
4. Chaining (confirmed in source): The source states this vulnerability "could be chained with CVE-2026-42271" — CVSS 8.7 HIGH, CWE-77/CWE-78 command injection, in CISA KEV since 2026-06-08 with EPSS 84%. The realistic chain is: smuggling-induced path confusion → bypass of path-based authentication on an affected endpoint → reach an endpoint vulnerable to CVE-2026-42271 → OS command injection with the privileges of the application process. Note that CVE-2026-42271's EPSS of 84% versus this CVE's 2% means the command injection flaw is the far more probable exploitation target on its own; the smuggling flaw is the enabler that makes it reachable without authentication.
5. Exploitation status: CVE-2026-48710 is in CISA KEV (added 2026-09-02), meaning CISA requires remediation by 2026-09-16 for in-scope organisations. "Known ransomware campaign use: Unknown" per the source — do not treat this as ransomware-linked.

Caveats and confidence: The technical description above is drawn from the NVD/CISA alert text, which is high-confidence for the vulnerability class and chaining claim but thin on exploitation specifics. No exploit code, no observed-in-the-wild attack details, no affected version ranges, and no patch version numbers are present in the provided source material. The chaining claim with CVE-2026-42271 is single-sourced (the CISA alert text); verify against the vendor's own advisory before relying on it for prioritisation decisions. Affected version identification must come from the vendor's advisory — do not assume all Starlette versions are affected.

4. Mitigation & containment

P1 — within 24 hours

• Inventory: Identify all Python services using Starlette (directly or via FastAPI) across the estate. Command example: pip list | grep -i starlette per environment, or query your SBOM/dependency tooling for starlette across all deployed images.
• Exposure triage: For each Starlette service, determine whether it is internet-facing and whether authentication/authorisation depends on URL path reconstruction (path-based middleware, path-prefix ACLs, reverse-proxy path routing). These are the high-risk assets.
• Interim containment for exposed, unpatchable services: Block or restrict requests where the Host header contains path-like characters (/, %2f, %2F, ;, encoded slashes) at the edge proxy/WAF. This directly disrupts the host-part path injection primitive. Example WAF logic: reject requests where the Host header matches / or %2[fF].
• Check for CVE-2026-42271 in the same estate: Given the documented chain and its 84% EPSS, any asset found vulnerable to CVE-2026-48710 must be checked against CVE-2026-42271 (in KEV since 2026-06-08) and patched on the same cycle — it should already have been remediated under the June KEV deadline.

P2 — within 72 hours

• Patch: Apply the vendor's fix for CVE-2026-48710 per vendor instructions. The source does not specify a fixed version number; obtain the patched version from the vendor's advisory and pin it in dependency manifests (requirements.txt, pyproject.toml, container base images).
• Regression-test path-based auth: After patching, test that path-dependent authentication middleware correctly rejects host-header path injection attempts (crafted requests with injected path segments in the Host header).
• Log review: Review edge/proxy and application logs back to at least 2026-09-02 (KEV addition date) for Host headers containing path characters or anomalous path-reconstruction errors. Any hits on internet-facing auth-protected endpoints warrant incident-response triage under CISA's forensics triage requirements referenced in the alert.

P3 — within 7 days

• Dependency governance: Add Starlette to the monitored-dependency list with version pinning and automated upgrade gates; ensure CI builds fail on known-vulnerable versions.
• Architecture review: Identify services where authentication is path-dependent by design and consider moving to explicit, non-path-derived authorisation checks to reduce the blast radius of future URL-reconstruction flaws.
• Verify the chain: Confirm with the vendor whether the CVE-2026-42271 chaining claim applies to your deployment pattern; if confirmed, treat the pair as a single combined risk item in your vulnerability register.

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators (derived from the vulnerability mechanism; no atomic IOCs exist in the source):

6. Detection

The sources provide no malicious file artefacts, command-line strings, mutexes, or hard-coded values — the threat here is a vulnerability, not a malware sample. However, the vulnerability's exploitation primitive (path characters in the Host header) is a distinctive network-level artefact and can be detected at the edge.

title: Starlette CVE-2026-48710 - Path Characters in HTTP Host Header
id: 7f3a2c1d-8e4b-4f5a-9c6d-1a2b3c4d5e6f
status: experimental
description: >
  Detects HTTP requests containing path separator characters in the Host header,
  consistent with the host-part path injection primitive exploited by CVE-2026-48710
  (Kludex Starlette HTTP request/response smuggling). Such requests may indicate
  attempted authentication bypass via URL path reconstruction manipulation.
references:

  - https://nvd.nist.gov/vuln/detail/CVE-2026-48710
author: Adverse Trace
date: 2026-09-02
logsource:
  category: proxy
  product: proxy
detection:
  selection:
    cs-method: 'GET'
    c-uri|contains: '/'
    c-useragent|exists: true
  filter_host:
    c-uri|re: '^[a-zA-Z0-9.-]+(:[0-9]+)?/'
  condition: selection and filter_host
falsepositives:

  - Misconfigured clients or health-check agents sending malformed Host headers
  - Some legitimate HTTP/2 :authority edge cases at certain proxies
level: high

Deployment note: This rule keys on the URI field containing a host-then-path pattern (e.g. example.com/protected/path appearing in the request line), which is the observable signature of host-part path injection at most proxy log formats. Tune per your proxy's log schema — the selection logic may need adaptation for WAF-native log formats. No YARA rule is possible: there are no file artefacts in the source material.

CVE assessment

2 referenced CVEs — 2 actively exploited (CISA KEV)

7. Sources

• NVD, "CVE-2026-48710 — Kludex Starlette: Kludex Starlette HTTP Request/Response Smuggling Vulnerability," https://nvd.nist.gov/vuln/detail/CVE-2026-48710, published 2026-09-01.
• CISA KEV entry for CVE-2026-48710 (added 2026-09-02, due 2026-09-16), as reflected in the alert content and verified reference data.

8. Adverse Trace position

CVE-2026-48710 is a MEDIUM-severity (CVSS 6.5) flaw whose real risk to EMEA financial services is as an enabler: on its own it is an authentication bypass on path-dependent auth (EPSS 2%, modest standalone likelihood), but chained with CVE-2026-42271 (CVSS 8.7 HIGH, EPSS 84%, KEV-listed since June) it provides unauthenticated reach to a command injection flaw — and the chaining claim is single-sourced from the CISA alert text, so verify it against the vendor advisory before treating the pair as a combined critical. Clients should treat internet-facing Starlette/FastAPI services with path-based authentication as the priority cohort, patch within the KEV window (due 2026-09-16), and confirm CVE-2026-42271 was remediated under its June deadline — if it wasn't, that is the more urgent finding. We will monitor for affected-version disclosure from the vendor, any proof-of-concept exploit publication, and independent confirmation of the chaining claim, and will reissue this advisory if the risk picture materially changes.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.