Intel

CVE-2026-48710

Red Hat Security Advisory: RHOAI 3.4.4 - Red Hat OpenShift AI

criticalKEV: actively exploitedPoCEPSS 36%

Description

A flaw was found in Starlette, a lightweight ASGI (Asynchronous Server Gateway Interface) framework. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP `Host` request header. This malformed header could cause the `request.url` to be incorrectly reconstructed, leading to a discrepancy with the actual requested path. Consequently, security restrictions enforced by middleware and endpoints that rely on `request.url` for validation could be bypassed, potentially allowing unauthorized access or actions.

Source: REDHAT_CSAFREDHAT_CSAFREDHAT_CSAFREDHAT_CSAFREDHAT_CSAFREDHAT_CSAFREDHAT_CSAFREDHAT_CSAFREDHAT_CSAFOSVNVDCVELISTV5CISA_KEVCVEORGREDHAT_CSAFOSVEUVDDEBIAN_DSA

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2026-48710 carries a CVSS 6.5 score with a network-accessible, no-authentication-required vector (AV:N/AC:L/PR:N/UI:N), meaning exploitation requires nothing more than a crafted HTTP header and is trivially scriptable at scale. The EPSS score of 80.4th percentile places it well above the median for exploitation likelihood across all known CVEs. The CISA-flagged chaining with CVE-2026-42271 is the key risk multiplier — organisations should treat both CVEs as a single attack chain and verify patch status for both simultaneously. NIS2-scoped organisations running Red Hat OpenShift AI, Ansible Automation Platform, or AI Inference Server — common in KRITIS environments with ML or automation infrastructure — face the highest exposure and should target patch deployment within the 24-hour window; the CISA KEV listing confirms active exploitation pressure regardless of the absence of a known ransomware campaign flag.

Runbook · Step 1

Immediate response (0-24 h)

  • Upgrade Starlette to version ≥ 1.0.1 — this is the only complete fix. Run pip install "starlette>=1.0.1" or rebuild affected container images. All deployments running Starlette < 1.0.1 are in scope.
  • Patch Red Hat products: AI Inference Server (affected: 3.3.0–3.3.5), OpenShift AI (3.3.x through 3.3.5, 3.4.x through 3.4.2), Migration Toolkit for Applications 8.2.0, Ansible Automation Platform, and OpenShift Lightspeed — consult the Red Hat Customer Portal for available errata; verify exact fixed versions in the vendor advisory.
  • Audit middleware and authentication logic: Identify every component that makes access-control decisions based on request.url or request.url.path instead of the raw ASGI scope["path"]. These are directly exploitable and must be prioritised.
  • Assess chaining with CVE-2026-42271: CISA explicitly flags this combination — determine whether CVE-2026-42271 is also unpatched in your stack; the chained attack can substantially increase the effective impact.
  • Validate Host headers at the reverse-proxy layer (Nginx/HAProxy/Envoy): Reject requests with syntactically invalid Host headers (containing path segments such as /, @, or #, or ports outside RFC 3986 §3.2.2) with HTTP 400 as a compensating control until the patch is deployed.

Runbook · Step 2

Mitigation layers

  • Reverse-proxy hardening (network layer): Add an Nginx directive if ($http_host !~ "^[a-zA-Z0-9._-]+(:[0-9]+)?$") { return 400; } in the server block to reject malformed Host headers before they reach the ASGI backend.
  • WAF rule: Enable ModSecurity/OWASP CRS rule group REQUEST-920-PROTOCOL-ENFORCEMENT, particularly Rule 920350 ("Host header is a numeric IP address"). Add a custom rule matching path characters in the Host header: pattern Host:.*[/@?#].
  • IAM / least-privilege code fix: Refactor authentication middleware to use scope["path"] (the raw ASGI scope value) rather than request.url.path. This is a targeted short-term code change that eliminates the bypass vector without requiring a full upgrade.
  • Network segmentation: Move Starlette-based services that enforce authentication via URL path (e.g. API gateways, ML inference endpoints in OpenShift AI) behind internal network segments; disable direct internet exposure where not operationally required.
  • Dependency pinning and SBOM scanning: Scan all container images and Python environments for Starlette < 1.0.1 using tools such as syft + grype. Add a CI/CD policy gate that blocks builds containing affected versions.

Runbook · Step 3

Detection rules

  • Web-server / proxy access logs: Search for requests where the Host header contains path-segment characters — SPL snippet: index=proxy sourcetype=access_combined | regex _raw="Host:\s*[^\r\n]*[/@#?]" — prioritise hits on authentication endpoints.
  • Suricata / Zeek network telemetry: Check the Zeek HTTP log field host for values that do not match ^[a-zA-Z0-9._-]+(:[0-9]+)?$: zeek_http | where not match(host, /^[a-zA-Z0-9._\-]+(:[0-9]+)?$/).
  • Application log anomaly: After applying the patch, Starlette logs a fallback to scope["server"] when a malformed Host header is detected — alert on log entries containing fallback to scope["server"] or on unexpected hostnames appearing in reconstructed URLs in application logs.
  • Sigma rule shape (authentication-bypass indicator): 
    title: Starlette Host Header Path Injection
logsource: category: webserver
detection:
  keywords: 'Host:*/*' OR 'Host:*@*'
condition: keywords
  • EDR / container runtime: Monitor for unexpected process spawns from the Starlette/Uvicorn process tree (e.g. shell execution) following HTTP requests with anomalous Host headers — Sysmon EID 1 or auditd execve events with the ASGI worker as parent PID.

Metrics

Severity
critical
Priority score
239.03
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
6.5
Source: nvd-v3
CVSS v3
6.5
CVSS v4
—
EPSS percentile
98.4 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
36.3 %
Elevated — model estimates 10-50% exploitation likelihood.
Published
2026-08-27 14:50 UTC
CWE
CWE-444

Weakness classes (CWE)

  • CWE-444Base

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

    The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

    cwe.mitre.org →

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Modified2026-09-03 13:05 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • SSVC: {"id":"CVE-2026-48710","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technica… → {"id":"CVE-2026-48710","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technic…
  2. CVE CISA KEV Update2026-09-02 19:00 UTC· 9119a7d8-5eab-497f-8521-727c672e3725
    • Date Added: 2026-09-02
    • Due Date: 2026-09-02
    • Required Action: 2026-09-02
    • Vulnerability Name: 2026-09-02
  3. CVE Modified2026-09-02 18:19 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • Reference: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48710
    • Reference: https://www.wiz.io/blog/ai-infrastructure-honeypot
    • Reference: https:/www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points
    • SSVC: {"id":"CVE-2026-48710","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalI… → {"id":"CVE-2026-48710","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"no"},{"technica…
  4. CVE Modified2026-08-28 16:18 UTC· security-advisories@github.com
    • Reference: https://badhost.org
    • Reference: https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6
    • Reference: https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr
    • Reference: https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml
  5. CVE Modified2026-08-28 16:18 UTC· 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
    • Affected: Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/48xxx/CVE-2026-48710.json">CVE-2026-48710</a>
    • Reference: https://access.redhat.com/errata/RHSA-2026:22992
    • Reference: https://access.redhat.com/errata/RHSA-2026:22993
    • Reference: https://access.redhat.com/errata/RHSA-2026:23346

Affected operating systems

  • linux

    debian / aomtrixie

  • linux

    redhat / enterprise_linux9.0

  • linux

    redhat / enterprise_linux10.0

  • linux

    redhat / enterprise_linux8.0

  • linux

    redhat / enterprise_linux_ai3.0

  • linux

    ubuntu / ffmpegbionic

  • linux

    ubuntu / ffmpegfocal

  • linux

    ubuntu / ffmpegjammy

  • linux

    ubuntu / ffmpegnoble

  • linux

    ubuntu / ffmpegxenial

  • linux

    ubuntu / pyasn1jammy

  • linux

    ubuntu / pyasn1noble

  • linux

    ubuntu / pyasn1resolute

  • linux

    debian / starlettetrixie

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • aiohttp

    aiohttp3.14.0

  • Atlassian

    BambooData Center LTS 10.2.22

  • Atlassian

    BambooData Center LTS 12.1.10

  • Atlassian

    BitbucketData Center 10.4.2

  • Atlassian

    BitbucketData Center LTS 10.2.6

  • Atlassian

    BitbucketData Center LTS 9.4.23

  • Atlassian

    ConfluenceData Center LTS 10.2.15

  • Atlassian

    ConfluenceData Center LTS 9.2.23

  • Atlassian

    Crucible4.9.13

  • Atlassian

    Fisheye4.9.13

  • Atlassian

    JiraData Center LTS 10.3.24

  • Atlassian

    JiraData Center LTS 11.3.10

  • axios

    axios0.19.0 – 0.31.1

  • axios

    axios1.0.0 – 1.15.2

  • axios

    axios1.0.0 – 1.16.0

  • axios

    axios1.7.0 – 1.16.0

  • axios

    axios0.32.0

  • beaugunderson

    ip-address10.1.1

  • bitnami

    argo-workflows3.0.0

  • bitnami

    jupyterlab4.0.0

  • bitnami

    jupyterlab

  • bitnami

    mlflow

  • bitnami

    pillow10.3.0

  • bitnami

    pillow5.1.0

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

Linked CVEs

Show 118 more CVEs
IDCVE-2026-48710