tag: Starlette · 2 items
- Engineer — Act: Starlette is the ASGI foundation under FastAPI and many Python web stacks; CISA KEV listing confirms active exploitation. Identify all services running Starlette, patch to the fixed version immediately, and audit request logs for anomalous Host header values as a signs-of-compromise check.
- SOC/IR — Act: KEV listing confirms in-the-wild exploitation of this host-header bypass; hunt for requests with unexpected or spoofed Host header values in web application and reverse-proxy logs dating back at least 30 days, then tune WAF or detection rules to alert on further attempts.
- Leader — Plan: Despite active exploitation, this is an engineering-tier patch event rather than a board-level systemic event — task your AppSec team this week to enumerate all internal and customer-facing services built on Starlette or FastAPI and confirm patching is on track before the next sprint cycle.
- Signals: CVE-2026-48710 — CISA KEV: listed, EPSS 0.07, public PoC on GitHub
- Engineer — Plan: Starlette is widely used in Python ASGI applications; a host-header auth bypass with a public GitHub PoC is a real exposure for any service relying on host-based access control. EPSS is 0.01 and no KEV listing, so immediate emergency patching isn’t warranted, but you should upgrade Starlette to the patched version within your next patch window and audit any middleware that trusts the Host header for routing or authorization decisions.
- SOC/IR — Skip
- Leader — Skip
- Signals: CVE-2026-48710 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub