CVE-2026-48710 CISA KEV · Actively exploitedSuited to automated attack · CISA
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
CVSS score
6.5
EPSS probability
%7.1
Risk score
0.9
Published
4 mo ago
Related Security News
Articles and analysis bulletins in which the press and security publications have covered this vulnerability:
When AI infrastructure becomes the target: Securing gateways and control points
Microsoft Threat Intelligence examines attacks on exposed AI workloads, including LiteLLM gateway exploitation, credential harvesting, persistence, and cryptomining activity. The post When AI infrastructure becomes the target: Securing gateways and control points appeared first on Microsoft Security Blog.
Similar Vulnerabilities
9.8
CVE-2012-4681 Actively exploitedVulnerability in N/a
Workaround Public Exploits:3EPSS %99
9.8
CVE-2012-1723 Actively exploitedVulnerability in N/a
Workaround Public Exploits:2EPSS %94
9.0
CVE-2021-40438 Actively exploitedmod_proxy SSRF
Patch verified Public Exploits:11EPSS %100
9.8
CVE-2017-12149 Actively exploitedDeserialization of untrusted data in Red Hat, Inc. Jbossas
Workaround Public Exploits:1EPSS %91
9.8
CVE-2016-8735 Actively exploitedVulnerability in Apache Tomcat
Partial patch Public Exploits:1EPSS %90
8.8
CVE-2026-42271 Actively exploitedCommand injection in Litellm
Patch verified Public Exploits:4EPSS %93
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-48710"