Critical Actively exploited

CVE-2026-48710

Kludex Starlette HTTP Request/Response Smuggling Vulnerability

What this means

Likelihood: Exploitation is not hypothetical: CISA has observed it in the wild.

What to doTop priority: CISA sets the remediation deadline at 16 September 2026.

Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.

Published: 2 September 2026
CVSS: —
EPSS: 11.04% probability of exploitation within 30 days · above 96% of all CVEs
Weakness: CWE-444
CISA due date: 16 September 2026
Sources: cisa-kev

Our analysis A CVSS 10 flaw turns Kestra into an unauthenticated root shell

References

https://nvd.nist.gov/vuln/detail/CVE-2026-48710