HIGH CISA-KEV ACTIVELY EXPLOITED

CVE-2026-48710

Kludex Starlette HTTP Request/Response Smuggling Vulnerability

Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271.

Affected Products

Kludex: Starlette

References

Published: 2026-09-02 · Source: CISA-KEV · Feed updated: 2026-09-02

This high severity vulnerability was published on 2026-09-02 via CISA-KEV. ⚠ This vulnerability is in the CISA Known Exploited Vulnerabilities (KEV) catalog — it is being actively exploited in the wild. Affected: Kludex: Starlette.

Risk Timeline

CVE Disclosed2026-09-02 · 0 days ago

CISA KEV — Actively ExploitedU.S. federal agencies required to patch · confirmed threat-actor activity

Remediation Resources

CISA / KEV

www.cisa.gov/known-exploited-vulnerabilities-catalog

NVD / MITRE

nvd.nist.gov/vuln/detail/CVE-2026-48710

vulnfeed aggregates 10363 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.