First published 9/27/2026, 6:50:15 AM · Last updated 9/27/2026, 6:50:15 AM

CVE-2026-48710: Kludex Starlette HTTP Request/Response Smuggling Vulnerability

Kludex Starlette has an HTTP request/response smuggling flaw that can allow attackers to inject paths into the host portion and thereby prepend the actual path. The excerpt warns this can lead to authentication bypass in cases where authentication depends on the reconstructed URL path and advises applying vendor mitigations and CISA BOD 26-04 guidance.

Categories: technology

Generated scores

Scores are based on the cited reporting and use a 1–10 scale. Read the methodology.

Confidence: 7/10How certain the assessment is based on the clarity and evidence in the cited reporting.
Geographic reach: 1/10How widely the event reaches, from a local area (1) to worldwide impact (10).
Global importance: 3/10The event's broader significance, from limited importance (1) to major global importance (10).
Impact magnitude: 6/10The scale or severity of the real-world impact, from minor (1) to extreme (10).
Positivity: 2/10How harmful or beneficial the event is, from strongly harmful (1) to strongly positive (10).
Urgency: 6/10How time-sensitive the event is, from low urgency (1) to immediate attention needed (10).

Why it matters

Because it can enable attackers to bypass authentication in affected deployments.

Location

Sources

CVE-2026-48710: Kludex Starlette HTTP Request/Response Smuggling Vulnerability

Report an issue