Kludex Starlette prior to version 1.0.1 did not validate the HTTP Host request header before using it to reconstruct request.url, an inconsistency classified as HTTP request/response smuggling (CWE-444). Because routing operates on the raw ASGI scope path while request.url is rebuilt from the unvalidated Host header, an attacker can send a malformed Host header so that request.url.path differs from the path the router actually processed. Any middleware or endpoint that enforces security restrictions based on request.url rather than the raw scope path can then be tricked into approving requests that should have been blocked, bypassing those controls. All Starlette deployments below 1.0.1 are affected, both direct users and downstream products that bundle the library, including Red Hat offerings such as Ansible Automation Platform, OpenShift AI, OpenShift Lightspeed, Satellite, AI Inference Server, Migration Toolkit for Applications, and Enterprise Linux AI. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-09-02, confirming active exploitation; related reporting describes attackers deploying reverse shells and crypto miners, and EPSS ranks it in the 98th percentile with a 36.3% probability of exploitation within 30 days.
What to do: Upgrade Starlette to 1.0.1 or later, which validates the Host header against RFC 9112/RFC 3986 grammar and falls back to scope['server'] for malformed values, and apply the corresponding Red Hat updates for each bundled product listed above. Until patched, review middleware and endpoints that enforce security decisions from request.url and validate or pin the Host header at your reverse proxy or load balancer. As a KEV entry, federal agencies must patch per BOD 26-04 timelines based on each asset's internet exposure, and operators of internet-facing AI infrastructure should verify their Starlette/FastAPI dependency versions.
Affected
Kludex (Encode) Starlette
All versions prior to 1.0.1
Red Hat AI Inference Server
—
Red Hat Ansible Automation Platform
—
Red Hat Migration Toolkit for Applications
—
Red Hat OpenShift AI
—
Red Hat OpenShift Lightspeed
—
Red Hat Satellite
—
Red Hat Enterprise Linux AI
—
Estimated exposure
mass>1M library deployments (Starlette is the core ASGI dependency beneath FastAPI and much of the Python AI-serving stack, with hundreds of millions of monthly… — Starlette is one of the most-downloaded Python web packages and is embedded both directly and via frameworks and AI gateways (including LiteLLM-based services and the listed Red Hat products), making the installed base clearly in the…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.
CISA Known Exploited Vulnerability
Affected
Kludex Starlette
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
starlette, ai inference server, ansible automation platform, migration toolkit for applications, openshift ai, openshift lightspeed, satellite, enterprise linux ai
CISA added seven actively exploited vulnerabilities to its KEV catalog, including SonicWall SMA 1000 SSRF CVE-2026-83548, amid campaigns deploying reverse shells and crypto miners.
CISA's KEV additions cover flaws in SonicWall SMA 1000 (CVE-2026-83548, CVE-2026-83549), Sangoma Switchvox (CVE-2026-9586), JFrog Artifactory (CVE-2026-82329), Kludex Starlette (CVE-2026-48710), Kestra OSS (CVE-2026-49869) and Berri LiteLLM's MCP endpoint (CVE-2026-59822). SonicWall confirmed active exploitation of the SMA 1000 flaws, while Microsoft and Wiz reported attackers chaining LiteLLM flaws CVE-2026-42271 and CVE-2026-48710 to fingerprint hosts, steal provider API keys and deploy XMRig miners on AI infrastructure. Wiz linked exploitation of the LiteLLM chain to the Qilin ransomware group, and Microsoft detailed a Kestra compromise chain ending in cryptocurrency mining and data harvesting via exposed RAGFlow flaws.
CISA added seven actively exploited vulnerabilities to its KEV catalog, including SonicWall SMA1000 SSRF and command injection flaws.
CISA added seven vulnerabilities with evidence of active exploitation to its Known Exploited Vulnerabilities catalog on September 2, 2026. The additions cover Sangoma Switchvox SQL injection (CVE-2026-9586), Kludex Starlette request smuggling (CVE-2026-48710), Kestra OS command injection (CVE-2026-49869), BerriAI LiteLLM (CVE-2026-59822) and JFrog Artifactory (CVE-2026-82329) authentication flaws, and SonicWall SMA1000 SSRF (CVE-2026-83548) and command injection (CVE-2026-83549) vulnerabilities. Under BOD 26-04, federal civilian agencies must prioritize rapid remediation of KEV-listed vulnerabilities on publicly exposed assets.
Wiz found 294 of 3,074 internet-facing LiteLLM gateways accepted the documented default admin key sk-1234, exposing provider API keys and cloud IAM credentials.
Wiz Research's February Shodan scan found 3,074 LiteLLM gateways, 294 of which accepted the setup guide's sk-1234 admin key; 191 had no master key set and would accept any credential. The master key doubles as the authentication switch, and before 1.82.0-stable a gateway started without one granted every request full admin rights, exposing stored provider API keys, prompts, and MCP-connected tools. A documented pass-through endpoint lacks checks against private and cloud metadata addresses, letting an admin-key holder retrieve cloud IAM credentials, though no real-world abuse is reported. Related LiteLLM flaws include CVE-2026-59821 (disputed guardrail code execution), CVE-2026-59822 (CVSS 8.8, added to CISA KEV on September 2 and observed against Wiz honeypots), and CVE-2026-42271, used to install a cryptominer.