Act
active
CVE-2026-48710: Starlette Host-Header Auth Bypass – KEV Listed
- Engineer — Act: Starlette is the ASGI foundation under FastAPI and many Python web stacks; CISA KEV listing confirms active exploitation. Identify all services running Starlette, patch to the fixed version immediately, and audit request logs for anomalous Host header values as a signs-of-compromise check.
- SOC/IR — Act: KEV listing confirms in-the-wild exploitation of this host-header bypass; hunt for requests with unexpected or spoofed Host header values in web application and reverse-proxy logs dating back at least 30 days, then tune WAF or detection rules to alert on further attempts.
- Leader — Plan: Despite active exploitation, this is an engineering-tier patch event rather than a board-level systemic event — task your AppSec team this week to enumerate all internal and customer-facing services built on Starlette or FastAPI and confirm patching is on track before the next sprint cycle.
- Signals: CVE-2026-48710 — CISA KEV: listed, EPSS 0.07, public PoC on GitHub
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.