AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

🔥 This vulnerability is being actively exploited in the wild (CISA Known Exploited Vulnerabilities catalog)

CVE-2026-48710: Kludex Starlette HTTP Request/Response Smuggling Vulnerability

highvulnerability🔥 Actively Exploited

security

Source: CISA Known Exploited VulnerabilitiesSeptember 1, 2026CVE-2026-48710

Summary

Kludex Starlette contains an HTTP request/response smuggling vulnerability (a technique where attackers manipulate how web servers process requests and responses) that allows attackers to inject malicious paths into the host part of a URL, potentially bypassing authentication systems that rely on checking the URL's path. This vulnerability is being actively exploited by attackers in the wild.

Solution / Mitigation

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 guidance on prioritizing security updates. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders must evaluate each system's internet exposure and ensure adherence to BOD 26-04 patching guidelines by the due date of 2026-09-16.