Kludex Starlette HTTP Request/Response Smuggling Vulnerability

Kludex Starlette

Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271. Added to CISA KEV on 2026-09-02 (federal deadline 2026-09-16).

First seen: 2 Sept 2026
Last update: 2 Sept 2026, 12:00 UTC
Identifiers: CVE-2026-48710
Source: CISA KEV

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Kludex Starlette HTTP Request/Response Smuggling Vulnerability
Severity: high, exploited in the wild. Patch status: patched.
Affected: Kludex Starlette
Ids: CVE-2026-48710

Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271. Added to CISA KEV on 2026-09-02 (federal deadline 2026-09-16).

## Steps
1. Search the repo, its CI and infra config for Kludex Starlette. If present, report the version in use and whether it's affected.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-48710") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://nvd.nist.gov/vuln/detail/CVE-2026-48710
https://pwned.coffee/i/kludex-starlette-http-request-response-smuggling-vulnera-cve-2026-48710

Sources

NVD: CVE-2026-48710

Totalone hot coffee