CVE-2026-48710 · Critical · CISA KEV

Kludex Starlette HTTP Request Smuggling: Authentication Bypass Risk (KEV)

Threat Engine Auto-Feed · data current as of 2026-09-03

A critical HTTP request/response smuggling vulnerability in Kludex Starlette (CVE-2026-48710) allows attackers to inject paths, potentially leading to authentication bypass. This flaw is actively exploited in the wild, as confirmed by its inclusion in CISA KEV, and has a high EPSS percentile, indicating significant exploitation probability.

  • CVSS:
  • EPSS percentile: 0.95605
  • Exploitation pressure: 82/100 (Critical)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 96th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability involves HTTP request/response smuggling, where an attacker manipulates the HTTP request to confuse a web server or proxy about the boundaries of an HTTP message. This confusion can lead to the server misinterpreting subsequent requests, allowing the attacker to inject malicious paths into the URL's host part. This can bypass authentication mechanisms that rely on the reconstructed URL's path for validation.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations using Kludex Starlette in their web applications, particularly those in Financial Services and Technology sectors, are at heightened risk due to confirmed adversary targeting.
  • Enterprises with complex web architectures involving proxies, load balancers, or reverse proxies that might interact with Starlette applications.

Misconfigurations that escalate it

  • Authentication mechanisms that solely depend on the URL's path for validation are highly susceptible.
  • Improper configuration of HTTP proxies or load balancers that do not correctly normalize or sanitize HTTP requests before forwarding them to the Starlette application.

High-impact scenarios

  • Successful exploitation can lead to authentication bypass, granting unauthorized access to sensitive application functionalities or data.
  • Attackers could chain this vulnerability with other flaws (e.g., CVE-2026-42271) to achieve more severe impacts, such as data exfiltration or full system compromise.

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor web server and application logs for unusual HTTP request patterns, particularly those with malformed or ambiguous headers that could indicate smuggling attempts.
  • Implement robust web application firewalls (WAFs) with rules designed to detect and block HTTP request smuggling techniques.
  • Regularly scan web applications for known vulnerabilities, including HTTP request smuggling, using DAST tools.

Contain

  • Isolate affected Kludex Starlette applications from public access if immediate patching is not feasible.
  • Review and strengthen authentication mechanisms to ensure they are not solely reliant on URL paths and incorporate multiple factors.
  • Implement strict input validation and sanitization for all incoming HTTP requests at the application and infrastructure layers.

Patch

  • Apply the latest security patches or updates provided by Kludex for Starlette to address CVE-2026-48710 as soon as they become available.

Frontier verdict — Critical

Prioritize patching CVE-2026-48710 due to active exploitation (CISA KEV) and high EPSS, posing a critical authentication bypass risk for Kludex Starlette users.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.