CVE-2026-48710 CISA KEV · Actively exploitedSuited to automated attack · CISA
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
CVSS score
6.5
EPSS probability
%7.1
Risk score
0.9
Published
4 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
Detection scanner for CVE-2026-48710 - Host-header auth bypass in Starlette/FastAPI
Makefile Go / Python
Nuclei: Starlette - Improper Validation of Unsafe Equivalence in Input
Makefile Go / Python
NVD reference
https://www.wiz.io/blog/ai-infrastructure-honeypot
Makefile Go / Python
Similar Vulnerabilities
9.8
CVE-2012-4681 Actively exploited
Vulnerability in N/a
N
Workaround Public Exploits:3EPSS %99
9.8
CVE-2012-1723 Actively exploited
Vulnerability in N/a
N
Workaround Public Exploits:2EPSS %94
9.0
CVE-2021-40438 Actively exploited
mod_proxy SSRF
AS
Patch verified Public Exploits:11EPSS %100
9.8
CVE-2017-12149 Actively exploited
Deserialization of untrusted data in Red Hat, Inc. Jbossas
RH
Workaround Public Exploits:1EPSS %91
9.8
CVE-2016-8735 Actively exploited
Vulnerability in Apache Tomcat
A
Partial patch Public Exploits:1EPSS %90
8.8
CVE-2026-42271 Actively exploited
Command injection in Litellm
L
Patch verified Public Exploits:3EPSS %93
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-48710"