{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:encode:starlette:*:*:*:*:*:python:*:*",
              "matchCriteriaId": "4C7C6045-86A6-4FAC-AE15-B12438E9D1B4",
              "versionEndExcluding": "1.0.1",
              "versionStartIncluding": "0.8.3",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 \u00a73.2 / RFC 3986 \u00a73.2.2 when constructing `request.url` and falls back to `scope[\"server\"]` for malformed values."
    }
  ],
  "id": "CVE-2026-48710",
  "lastModified": "2026-06-16T13:16:35.400",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.5,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.5,
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-05-26T22:16:44.020",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "url": "https://badhost.org"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "url": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Mitigation",
        "Third Party Advisory"
      ],
      "url": "https://www.secwest.net/starlette"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Mitigation",
        "Third Party Advisory"
      ],
      "url": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/security/cve/CVE-2026-48710"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "url": "https://badhost.org"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "url": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48710"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "tags": [
        "Exploit",
        "Mitigation",
        "Third Party Advisory"
      ],
      "url": "https://www.secwest.net/starlette"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "tags": [
        "Exploit",
        "Mitigation",
        "Third Party Advisory"
      ],
      "url": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-444"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1289"
        }
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.0.0"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "starlette"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-48710"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-444"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-04T13:15:17Z",
    "nvd_published_at": "2026-05-26T22:16:44Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nIn affected versions, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed.\n\n### Details\nWhen a client requests `http://example.com/foo`, it sends:\n\n```http\nGET /foo HTTP/1.1\nHost: example.com\n```\n\nAffected versions reconstructed the URL by concatenating `http://{host}{path}` and re-parsing the result. The `Host` value is only valid as a `uri-host [ \":\" port ]` per [RFC 9112 \u00a73.2](https://www.rfc-editor.org/rfc/rfc9112.html#section-3.2-6), where `uri-host` follows the restricted `host` grammar of [RFC 3986 \u00a73.2.2](https://www.rfc-editor.org/rfc/rfc3986.html#section-3.2.2). When it contains characters outside that grammar - notably `/`, `?`, or `#` - those characters move the path/query/fragment boundaries during re-parsing, so the parsed `request.url.path` no longer matches the path the server actually received. For example:\n\n```http\nGET /foo HTTP/1.1\nHost: example.com/abc?bar=\n```\n\nreconstructs to `http://example.com/abc?bar=/foo`, whose parsed `path` is `/abc` - even though routing used the real path `/foo`. The router still dispatches to `/foo` and the endpoint executes, but any middleware or code that reads `request.url.path` sees `/abc`, so path-based authorization checks can be bypassed.\n\n### Impact\nAny application running an affected version that relies on `request.url` (or `request.url.path`) for security-sensitive decisions is affected. The most common case is middleware that gates access to certain path prefixes based on `request.url.path`. Deployments fronted by a proxy or load balancer are mitigated only if that proxy rejects or normalizes the malformed `Host` header before forwarding and the application does not trust attacker-controlled host headers (e.g. `X-Forwarded-Host`) elsewhere.\n\n### Mitigation\nUpgrade to a patched version, which validates the `Host` header against the grammar of [RFC 9112 \u00a73.2](https://www.rfc-editor.org/rfc/rfc9112.html#section-3.2-6) / [RFC 3986 \u00a73.2.2](https://www.rfc-editor.org/rfc/rfc3986.html#section-3.2.2) when constructing `request.url` and falls back to `scope[\"server\"]` for malformed values.",
  "id": "GHSA-86qp-5c8j-p5mr",
  "modified": "2026-06-04T13:15:18Z",
  "published": "2026-06-04T13:15:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48710"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6"
    },
    {
      "type": "WEB",
      "url": "https://badhost.org"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Kludex/starlette"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml"
    },
    {
      "type": "WEB",
      "url": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette"
    },
    {
      "type": "WEB",
      "url": "https://www.secwest.net/starlette"
    },
    {
      "type": "WEB",
      "url": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks"
}

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Er is een kwetsbaarheid verholpen in Starlette, een Python-library voor het ontwikkelen van webservices. Starlette wordt door verschillende producten gebruikt, waaronder FastAPI.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "Een ongeauthenticeerde kwaadwillende kan de kwetsbaarheid misbruiken voor het omzeilen van authenticatie. Hierdoor kan de kwaadwillende afgeschermde URL-paden benaderen. Zodoende krijgt de kwaadwillende ongeauthenticeerde toegang tot functionaliteiten of data van een webservice die een kwetsbare Starlette-versie gebruikt.\n\nDe kwetsbaarheid wordt veroorzaakt doordat het pad in de Host-header onvoldoende wordt geverifieerd. De mogelijke impact van misbruik is afhankelijk van het soort data dat door een kwetsbare webservice wordt verwerkt en de functionaliteiten die deze service biedt.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheid is verholpen in Starlette versie 1.0.1. Applicaties die Startelle gebruiken, dienen Starlette bij te werken naar deze of een latere versie.\n\nIndien jouw organisatie applicaties gebruikt waar Starlette onderdeel van is, zoals FastAPI, dan ben je voor beveiligingsupdates mogelijk afhankelijk van je leverancier.\n\nWanneer een van je applicaties een kwetsbare versie van Starlette gebruikt en het niet mogelijk is om Starlette te updaten, kan de kans op misbruik worden beperkt door de kwetsbare applicatie niet naar het internet te ontsluiten of authenticatie via een reverse proxy in te regelen.\n\nLees de bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
        "title": "CWE-444"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://badhost.org/"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr"
      }
    ],
    "title": "Kwetsbaarheid verholpen in Starlette",
    "tracking": {
      "current_release_date": "2026-05-29T19:08:23.623424Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2026-0171",
      "initial_release_date": "2026-05-29T19:08:23.623424Z",
      "revision_history": [
        {
          "date": "2026-05-29T19:08:23.623424Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "starlette"
          }
        ],
        "category": "vendor",
        "name": "Kludex"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-48710",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
          "title": "CWE-444"
        },
        {
          "category": "description",
          "text": "Starlette versions before 1.0.1 did not validate the HTTP Host header when reconstructing request URLs, allowing attackers to inject paths and potentially bypass authentication based on the reconstructed URL path.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-48710 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-48710.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-48710"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "python311-starlette-1.2.0-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the python311-starlette-1.2.0-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-11026",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11026-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-48710 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-48710/"
      }
    ],
    "title": "python311-starlette-1.2.0-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-06-13T00:00:00Z",
      "generator": {
        "date": "2026-06-13T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:11026-1",
      "initial_release_date": "2026-06-13T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-06-13T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python311-starlette-1.2.0-1.1.aarch64",
                "product": {
                  "name": "python311-starlette-1.2.0-1.1.aarch64",
                  "product_id": "python311-starlette-1.2.0-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python313-starlette-1.2.0-1.1.aarch64",
                "product": {
                  "name": "python313-starlette-1.2.0-1.1.aarch64",
                  "product_id": "python313-starlette-1.2.0-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python314-starlette-1.2.0-1.1.aarch64",
                "product": {
                  "name": "python314-starlette-1.2.0-1.1.aarch64",
                  "product_id": "python314-starlette-1.2.0-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python311-starlette-1.2.0-1.1.ppc64le",
                "product": {
                  "name": "python311-starlette-1.2.0-1.1.ppc64le",
                  "product_id": "python311-starlette-1.2.0-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python313-starlette-1.2.0-1.1.ppc64le",
                "product": {
                  "name": "python313-starlette-1.2.0-1.1.ppc64le",
                  "product_id": "python313-starlette-1.2.0-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python314-starlette-1.2.0-1.1.ppc64le",
                "product": {
                  "name": "python314-starlette-1.2.0-1.1.ppc64le",
                  "product_id": "python314-starlette-1.2.0-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python311-starlette-1.2.0-1.1.s390x",
                "product": {
                  "name": "python311-starlette-1.2.0-1.1.s390x",
                  "product_id": "python311-starlette-1.2.0-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python313-starlette-1.2.0-1.1.s390x",
                "product": {
                  "name": "python313-starlette-1.2.0-1.1.s390x",
                  "product_id": "python313-starlette-1.2.0-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python314-starlette-1.2.0-1.1.s390x",
                "product": {
                  "name": "python314-starlette-1.2.0-1.1.s390x",
                  "product_id": "python314-starlette-1.2.0-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python311-starlette-1.2.0-1.1.x86_64",
                "product": {
                  "name": "python311-starlette-1.2.0-1.1.x86_64",
                  "product_id": "python311-starlette-1.2.0-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python313-starlette-1.2.0-1.1.x86_64",
                "product": {
                  "name": "python313-starlette-1.2.0-1.1.x86_64",
                  "product_id": "python313-starlette-1.2.0-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python314-starlette-1.2.0-1.1.x86_64",
                "product": {
                  "name": "python314-starlette-1.2.0-1.1.x86_64",
                  "product_id": "python314-starlette-1.2.0-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-starlette-1.2.0-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-starlette-1.2.0-1.1.aarch64"
        },
        "product_reference": "python311-starlette-1.2.0-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-starlette-1.2.0-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-starlette-1.2.0-1.1.ppc64le"
        },
        "product_reference": "python311-starlette-1.2.0-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-starlette-1.2.0-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-starlette-1.2.0-1.1.s390x"
        },
        "product_reference": "python311-starlette-1.2.0-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-starlette-1.2.0-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-starlette-1.2.0-1.1.x86_64"
        },
        "product_reference": "python311-starlette-1.2.0-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-starlette-1.2.0-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-starlette-1.2.0-1.1.aarch64"
        },
        "product_reference": "python313-starlette-1.2.0-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-starlette-1.2.0-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-starlette-1.2.0-1.1.ppc64le"
        },
        "product_reference": "python313-starlette-1.2.0-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-starlette-1.2.0-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-starlette-1.2.0-1.1.s390x"
        },
        "product_reference": "python313-starlette-1.2.0-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python313-starlette-1.2.0-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python313-starlette-1.2.0-1.1.x86_64"
        },
        "product_reference": "python313-starlette-1.2.0-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-starlette-1.2.0-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-starlette-1.2.0-1.1.aarch64"
        },
        "product_reference": "python314-starlette-1.2.0-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-starlette-1.2.0-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-starlette-1.2.0-1.1.ppc64le"
        },
        "product_reference": "python314-starlette-1.2.0-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-starlette-1.2.0-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-starlette-1.2.0-1.1.s390x"
        },
        "product_reference": "python314-starlette-1.2.0-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python314-starlette-1.2.0-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python314-starlette-1.2.0-1.1.x86_64"
        },
        "product_reference": "python314-starlette-1.2.0-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-48710",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-48710"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 3.2 / RFC 3986 3.2.2 when constructing `request.url` and falls back to `scope[\"server\"]` for malformed values.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python311-starlette-1.2.0-1.1.aarch64",
          "openSUSE Tumbleweed:python311-starlette-1.2.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python311-starlette-1.2.0-1.1.s390x",
          "openSUSE Tumbleweed:python311-starlette-1.2.0-1.1.x86_64",
          "openSUSE Tumbleweed:python313-starlette-1.2.0-1.1.aarch64",
          "openSUSE Tumbleweed:python313-starlette-1.2.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python313-starlette-1.2.0-1.1.s390x",
          "openSUSE Tumbleweed:python313-starlette-1.2.0-1.1.x86_64",
          "openSUSE Tumbleweed:python314-starlette-1.2.0-1.1.aarch64",
          "openSUSE Tumbleweed:python314-starlette-1.2.0-1.1.ppc64le",
          "openSUSE Tumbleweed:python314-starlette-1.2.0-1.1.s390x",
          "openSUSE Tumbleweed:python314-starlette-1.2.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-48710",
          "url": "https://www.suse.com/security/cve/CVE-2026-48710"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1266369 for CVE-2026-48710",
          "url": "https://bugzilla.suse.com/1266369"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python311-starlette-1.2.0-1.1.aarch64",
            "openSUSE Tumbleweed:python311-starlette-1.2.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-starlette-1.2.0-1.1.s390x",
            "openSUSE Tumbleweed:python311-starlette-1.2.0-1.1.x86_64",
            "openSUSE Tumbleweed:python313-starlette-1.2.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-starlette-1.2.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-starlette-1.2.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-starlette-1.2.0-1.1.x86_64",
            "openSUSE Tumbleweed:python314-starlette-1.2.0-1.1.aarch64",
            "openSUSE Tumbleweed:python314-starlette-1.2.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-starlette-1.2.0-1.1.s390x",
            "openSUSE Tumbleweed:python314-starlette-1.2.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python311-starlette-1.2.0-1.1.aarch64",
            "openSUSE Tumbleweed:python311-starlette-1.2.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-starlette-1.2.0-1.1.s390x",
            "openSUSE Tumbleweed:python311-starlette-1.2.0-1.1.x86_64",
            "openSUSE Tumbleweed:python313-starlette-1.2.0-1.1.aarch64",
            "openSUSE Tumbleweed:python313-starlette-1.2.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python313-starlette-1.2.0-1.1.s390x",
            "openSUSE Tumbleweed:python313-starlette-1.2.0-1.1.x86_64",
            "openSUSE Tumbleweed:python314-starlette-1.2.0-1.1.aarch64",
            "openSUSE Tumbleweed:python314-starlette-1.2.0-1.1.ppc64le",
            "openSUSE Tumbleweed:python314-starlette-1.2.0-1.1.s390x",
            "openSUSE Tumbleweed:python314-starlette-1.2.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-06-13T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-48710"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "starlette",
        "purl": "pkg:pypi/starlette"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1.0",
        "0.1.1",
        "0.1.10",
        "0.1.11",
        "0.1.12",
        "0.1.13",
        "0.1.14",
        "0.1.15",
        "0.1.16",
        "0.1.17",
        "0.1.2",
        "0.1.3",
        "0.1.4",
        "0.1.5",
        "0.1.6",
        "0.1.7",
        "0.1.8",
        "0.1.9",
        "0.10.0",
        "0.10.1",
        "0.10.2",
        "0.10.3",
        "0.10.4",
        "0.10.5",
        "0.10.6",
        "0.10.7",
        "0.11.0",
        "0.11.1",
        "0.11.2",
        "0.11.3",
        "0.11.4",
        "0.12.0",
        "0.12.0b1",
        "0.12.0b2",
        "0.12.0b3",
        "0.12.1",
        "0.12.10",
        "0.12.11",
        "0.12.12",
        "0.12.13",
        "0.12.2",
        "0.12.3",
        "0.12.4",
        "0.12.5",
        "0.12.6",
        "0.12.7",
        "0.12.8",
        "0.12.9",
        "0.13.0",
        "0.13.1",
        "0.13.2",
        "0.13.3",
        "0.13.4",
        "0.13.5",
        "0.13.6",
        "0.13.7",
        "0.13.8",
        "0.14.0",
        "0.14.1",
        "0.14.2",
        "0.15.0",
        "0.16.0",
        "0.17.0",
        "0.17.1",
        "0.18.0",
        "0.19.0",
        "0.19.1",
        "0.2.0",
        "0.2.1",
        "0.2.2",
        "0.2.3",
        "0.20.0",
        "0.20.1",
        "0.20.2",
        "0.20.3",
        "0.20.4",
        "0.21.0",
        "0.22.0",
        "0.23.0",
        "0.23.1",
        "0.24.0",
        "0.25.0",
        "0.26.0",
        "0.26.0.post1",
        "0.26.1",
        "0.27.0",
        "0.28.0",
        "0.29.0",
        "0.3.0",
        "0.3.1",
        "0.3.2",
        "0.3.3",
        "0.3.4",
        "0.3.5",
        "0.3.6",
        "0.3.7",
        "0.30.0",
        "0.31.0",
        "0.31.1",
        "0.32.0",
        "0.32.0.post1",
        "0.33.0",
        "0.34.0",
        "0.35.0",
        "0.35.1",
        "0.36.0",
        "0.36.1",
        "0.36.2",
        "0.36.3",
        "0.37.0",
        "0.37.1",
        "0.37.2",
        "0.38.0",
        "0.38.1",
        "0.38.2",
        "0.38.3",
        "0.38.4",
        "0.38.5",
        "0.38.6",
        "0.39.0",
        "0.39.1",
        "0.39.2",
        "0.4.0",
        "0.4.1",
        "0.4.2",
        "0.40.0",
        "0.41.0",
        "0.41.1",
        "0.41.2",
        "0.41.3",
        "0.42.0",
        "0.43.0",
        "0.44.0",
        "0.45.0",
        "0.45.1",
        "0.45.2",
        "0.45.3",
        "0.46.0",
        "0.46.1",
        "0.46.2",
        "0.47.0",
        "0.47.1",
        "0.47.2",
        "0.47.3",
        "0.48.0",
        "0.49.0",
        "0.49.1",
        "0.49.2",
        "0.49.3",
        "0.5.0",
        "0.5.1",
        "0.5.2",
        "0.5.3",
        "0.5.4",
        "0.5.5",
        "0.50.0",
        "0.51.0",
        "0.52.0",
        "0.52.1",
        "0.6.0",
        "0.6.1",
        "0.6.2",
        "0.6.3",
        "0.7.0",
        "0.7.1",
        "0.7.2",
        "0.7.3",
        "0.7.4",
        "0.8.0",
        "0.8.1",
        "0.8.2",
        "0.8.3",
        "0.8.4",
        "0.8.5",
        "0.8.6",
        "0.8.7",
        "0.8.8",
        "0.9.0",
        "0.9.1",
        "0.9.10",
        "0.9.11",
        "0.9.2",
        "0.9.3",
        "0.9.4",
        "0.9.5",
        "0.9.6",
        "0.9.7",
        "0.9.8",
        "0.9.9",
        "1.0.0",
        "1.0.0rc1"
      ]
    }
  ],
  "aliases": [
    "X41-2026-002",
    "CVE-2026-48710",
    "GHSA-86qp-5c8j-p5mr"
  ],
  "details": "Starlette reconstructs the requested URL based on the HTTP Host request header and requested path, but does not perform any validation of the Host header value. This allows attackers to inject paths into the host part, prepending the actual path. However, routing in Starlette is based on the actual request path. This inconsistent interpretation of HTTP requests may lead to issues such as authentication bypass when the authentication depends on the reconstructed URL\u2019s path.",
  "id": "PYSEC-2026-161",
  "modified": "2026-05-22T13:11:38.659740Z",
  "references": [
    {
      "type": "ARTICLE",
      "url": "https://badhost.org"
    },
    {
      "type": "ARTICLE",
      "url": "https://www.secwest.net/starlette"
    },
    {
      "type": "ARTICLE",
      "url": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette/"
    },
    {
      "type": "DETECTION",
      "url": "https://badhost.org"
    },
    {
      "type": "EVIDENCE",
      "url": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr"
    },
    {
      "type": "ADVISORY",
      "url": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette/"
    },
    {
      "type": "FIX",
      "url": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6"
    }
  ],
  "summary": "BadHost: Missing Host header validation poisons request.url.path, bypassing path-based security checks"
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A new satellite/foreman-mcp-server-rhel9 container image is now available as a Technology Preview in the Red Hat container registry.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Satellite provides a container image that you can use to run an MCP server locally. The MCP server for Satellite is designed for advanced reporting and data analysis that leverages AI capabilities. You can use it to generate dynamic and comprehensive reports from your Satellite inventory.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:22992",
        "url": "https://access.redhat.com/errata/RHSA-2026:22992"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-48710",
        "url": "https://access.redhat.com/security/cve/CVE-2026-48710"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://catalog.redhat.com/software/containers/search",
        "url": "https://catalog.redhat.com/software/containers/search"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22992.json"
      }
    ],
    "title": "Red Hat Security Advisory: satellite/foreman-mcp-server-rhel9 container image available as a Technology Preview",
    "tracking": {
      "current_release_date": "2026-06-09T17:12:46+00:00",
      "generator": {
        "date": "2026-06-09T17:12:46+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.2"
        }
      },
      "id": "RHSA-2026:22992",
      "initial_release_date": "2026-06-03T19:56:00+00:00",
      "revision_history": [
        {
          "date": "2026-06-03T19:56:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-06-03T19:56:03+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-06-09T17:12:46+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Satellite 6.19",
                "product": {
                  "name": "Red Hat Satellite 6.19",
                  "product_id": "Red Hat Satellite 6.19",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:satellite:6.19::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Satellite"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:e0806dac8faa67ce76dc49de793a10ed7e7d5c03dcbbafc36987b24a5c28fd9b_amd64",
                "product": {
                  "name": "registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:e0806dac8faa67ce76dc49de793a10ed7e7d5c03dcbbafc36987b24a5c28fd9b_amd64",
                  "product_id": "registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:e0806dac8faa67ce76dc49de793a10ed7e7d5c03dcbbafc36987b24a5c28fd9b_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/foreman-mcp-server-rhel9@sha256%3Ae0806dac8faa67ce76dc49de793a10ed7e7d5c03dcbbafc36987b24a5c28fd9b?arch=amd64\u0026repository_url=registry.redhat.io/satellite/foreman-mcp-server-rhel9\u0026tag=1780492012"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:e0806dac8faa67ce76dc49de793a10ed7e7d5c03dcbbafc36987b24a5c28fd9b_amd64 as a component of Red Hat Satellite 6.19",
          "product_id": "Red Hat Satellite 6.19:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:e0806dac8faa67ce76dc49de793a10ed7e7d5c03dcbbafc36987b24a5c28fd9b_amd64"
        },
        "product_reference": "registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:e0806dac8faa67ce76dc49de793a10ed7e7d5c03dcbbafc36987b24a5c28fd9b_amd64",
        "relates_to_product_reference": "Red Hat Satellite 6.19"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-48710",
      "cwe": {
        "id": "CWE-1289",
        "name": "Improper Validation of Unsafe Equivalence in Input"
      },
      "discovery_date": "2026-05-26T23:01:03.204374+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2481742"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Starlette, a lightweight ASGI (Asynchronous Server Gateway Interface) framework. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP `Host` request header. This malformed header could cause the `request.url` to be incorrectly reconstructed, leading to a discrepancy with the actual requested path. Consequently, security restrictions enforced by middleware and endpoints that rely on `request.url` for validation could be bypassed, potentially allowing unauthorized access or actions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "starlette: Starlette: Security restriction bypass via malformed HTTP Host header",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The impact is rated as Critical because path-based authentication and access control middleware can be completely bypassed by an unauthenticated remote attacker using a crafted HTTP Host header.\n\nStarlette reconstructs `request.url` by combining the HTTP Host header value with the request path, but performs no validation on the Host header. An attacker can inject path separators or query characters into the Host header (e.g., `Host: example.com/health?x=`), causing `request.url.path` to return a value that differs from the actual HTTP `request path` used for routing. Middleware that enforces authentication or authorization decisions based on `request.url.path` will evaluate the injected path rather than the real one, allowing the attacker to reach protected endpoints.\n\nWith regard to CVSS metrics, the Attack Vector (AV) is Network and Privileges Required (PR) is None, because the attack requires only the ability to send HTTP requests with a crafted Host header. User interaction is not required.\n\nRed Hat Satellite / Insights (IoP): The starlette package is included as a dependency of Connexion, but this flaw is rated Low impact because these services do not use path-based authentication middleware and all services are deployed behind reverse proxies. \n\nOpenShift Lightspeed (OLS): The starlette package is included as a dependency, but this flaw is rated Low impact because authentication is enforced via Kubernetes TokenReview/SubjectAccessReview through FastAPI dependency injection, not path-based middleware; request.url.path is only used for metrics and response header application.\n\nRHOAI Kubeflow Training images: starlette is being used as indirect dependency of mlflow, but this flaw is rated as Low impact because mlflow is used as client library only to store training metrics on remote server, it doesn\u0027t expose any endpoint.\n\nRHOAI odh-automl: The impact is reduced to Low since starlette is only used in the backend and it\u0027s transient dependency and starlette is not used at all to serve any endpoints.\n\nRHOAI odh-kserve-autogluon-server-rhel9: While the Starlette dependency is present in the build, the vulnerable code in starlette is not reachable. This reduces the impact to low.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.19:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:e0806dac8faa67ce76dc49de793a10ed7e7d5c03dcbbafc36987b24a5c28fd9b_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48710"
        },
        {
          "category": "external",
          "summary": "RHBZ#2481742",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481742"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48710",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48710"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48710",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48710"
        },
        {
          "category": "external",
          "summary": "https://badhost.org",
          "url": "https://badhost.org"
        },
        {
          "category": "external",
          "summary": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6",
          "url": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6"
        },
        {
          "category": "external",
          "summary": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr",
          "url": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr"
        },
        {
          "category": "external",
          "summary": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml",
          "url": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml"
        },
        {
          "category": "external",
          "summary": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette",
          "url": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette"
        },
        {
          "category": "external",
          "summary": "https://www.secwest.net/starlette",
          "url": "https://www.secwest.net/starlette"
        },
        {
          "category": "external",
          "summary": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette",
          "url": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette"
        }
      ],
      "release_date": "2026-05-26T21:54:54.393000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-03T19:56:00+00:00",
          "details": "For Satellite MCP integration see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:e0806dac8faa67ce76dc49de793a10ed7e7d5c03dcbbafc36987b24a5c28fd9b_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:22992"
        },
        {
          "category": "workaround",
          "details": "Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes.\n\nIf custom middleware is present, it should be updated to use `request.scope[\"path\"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target.",
          "product_ids": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:e0806dac8faa67ce76dc49de793a10ed7e7d5c03dcbbafc36987b24a5c28fd9b_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.19:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:e0806dac8faa67ce76dc49de793a10ed7e7d5c03dcbbafc36987b24a5c28fd9b_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "starlette: Starlette: Security restriction bypass via malformed HTTP Host header"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A new satellite/foreman-mcp-server-rhel9 container image is now available as a Technology Preview in the Red Hat container registry.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Satellite provides a container image that you can use to run an MCP server locally. The MCP server for Satellite is designed for advanced reporting and data analysis that leverages AI capabilities. You can use it to generate dynamic and comprehensive reports from your Satellite inventory.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:22993",
        "url": "https://access.redhat.com/errata/RHSA-2026:22993"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-34444",
        "url": "https://access.redhat.com/security/cve/CVE-2026-34444"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-48710",
        "url": "https://access.redhat.com/security/cve/CVE-2026-48710"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://catalog.redhat.com/software/containers/search",
        "url": "https://catalog.redhat.com/software/containers/search"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.18/html/updating_red_hat_satellite/index",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.18/html/updating_red_hat_satellite/index"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-26007",
        "url": "https://access.redhat.com/security/cve/CVE-2026-26007"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-62727",
        "url": "https://access.redhat.com/security/cve/CVE-2025-62727"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22993.json"
      }
    ],
    "title": "Red Hat Security Advisory: satellite/foreman-mcp-server-rhel9 container image available as a Technology Preview",
    "tracking": {
      "current_release_date": "2026-06-09T17:12:47+00:00",
      "generator": {
        "date": "2026-06-09T17:12:47+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.2"
        }
      },
      "id": "RHSA-2026:22993",
      "initial_release_date": "2026-06-03T20:30:54+00:00",
      "revision_history": [
        {
          "date": "2026-06-03T20:30:54+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-06-03T20:30:58+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-06-09T17:12:47+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Satellite 6.18",
                "product": {
                  "name": "Red Hat Satellite 6.18",
                  "product_id": "Red Hat Satellite 6.18",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:satellite:6.18::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Satellite"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:f53ba238ef1d3373eaeae20953ea029affe3583e47f5e41e847d8ffbe9ca5217_amd64",
                "product": {
                  "name": "registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:f53ba238ef1d3373eaeae20953ea029affe3583e47f5e41e847d8ffbe9ca5217_amd64",
                  "product_id": "registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:f53ba238ef1d3373eaeae20953ea029affe3583e47f5e41e847d8ffbe9ca5217_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/foreman-mcp-server-rhel9@sha256%3Af53ba238ef1d3373eaeae20953ea029affe3583e47f5e41e847d8ffbe9ca5217?arch=amd64\u0026repository_url=registry.redhat.io/satellite/foreman-mcp-server-rhel9\u0026tag=1780492008"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:f53ba238ef1d3373eaeae20953ea029affe3583e47f5e41e847d8ffbe9ca5217_amd64 as a component of Red Hat Satellite 6.18",
          "product_id": "Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:f53ba238ef1d3373eaeae20953ea029affe3583e47f5e41e847d8ffbe9ca5217_amd64"
        },
        "product_reference": "registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:f53ba238ef1d3373eaeae20953ea029affe3583e47f5e41e847d8ffbe9ca5217_amd64",
        "relates_to_product_reference": "Red Hat Satellite 6.18"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-62727",
      "cwe": {
        "id": "CWE-407",
        "name": "Inefficient Algorithmic Complexity"
      },
      "discovery_date": "2025-10-28T21:01:03.833849+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2406929"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service vulnerability has been discovered in the python Starlette framework. an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette\u0027s FileResponse Range parsing/merging logic. This induces CPU exhaustion per request, causing a denial\u2011of\u2011service for endpoints serving files.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "starlette: Starlette DoS via Range header merging",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:f53ba238ef1d3373eaeae20953ea029affe3583e47f5e41e847d8ffbe9ca5217_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-62727"
        },
        {
          "category": "external",
          "summary": "RHBZ#2406929",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2406929"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-62727",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-62727"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-62727",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62727"
        },
        {
          "category": "external",
          "summary": "https://github.com/Kludex/starlette/commit/4ea6e22b489ec388d6004cfbca52dd5b147127c5",
          "url": "https://github.com/Kludex/starlette/commit/4ea6e22b489ec388d6004cfbca52dd5b147127c5"
        },
        {
          "category": "external",
          "summary": "https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8",
          "url": "https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8"
        }
      ],
      "release_date": "2025-10-28T20:14:53.655000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-03T20:30:54+00:00",
          "details": "For Satellite MCP integration see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:f53ba238ef1d3373eaeae20953ea029affe3583e47f5e41e847d8ffbe9ca5217_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:22993"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:f53ba238ef1d3373eaeae20953ea029affe3583e47f5e41e847d8ffbe9ca5217_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:f53ba238ef1d3373eaeae20953ea029affe3583e47f5e41e847d8ffbe9ca5217_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "starlette: Starlette DoS via Range header merging"
    },
    {
      "cve": "CVE-2026-26007",
      "cwe": {
        "id": "CWE-354",
        "name": "Improper Validation of Integrity Check Value"
      },
      "discovery_date": "2026-02-10T22:01:01.036116+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2438762"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A validation flaw has been discovered in the python cryptography package. This missing validation allows an attacker to provide a public key point P from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the victim computes the shared secret as S = [victim_private_key]P via ECDH, this leaks information about victim_private_key mod (small_subgroup_order). For curves with cofactor \u003e 1, this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA , it\u0027s easy to forge signatures on the small subgroup. Only SECT curves are impacted by this.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw, while difficult to exploit, would lead to a loss of integrity in the encrypted communication channel. Given that the cryptography package is a library, it is likely to be used in situations that do not require user interaction.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:f53ba238ef1d3373eaeae20953ea029affe3583e47f5e41e847d8ffbe9ca5217_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-26007"
        },
        {
          "category": "external",
          "summary": "RHBZ#2438762",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2438762"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-26007",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-26007"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-26007",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26007"
        },
        {
          "category": "external",
          "summary": "https://github.com/pyca/cryptography/commit/0eebb9dbb6343d9bc1d91e5a2482ed4e054a6d8c",
          "url": "https://github.com/pyca/cryptography/commit/0eebb9dbb6343d9bc1d91e5a2482ed4e054a6d8c"
        },
        {
          "category": "external",
          "summary": "https://github.com/pyca/cryptography/security/advisories/GHSA-r6ph-v2qm-q3c2",
          "url": "https://github.com/pyca/cryptography/security/advisories/GHSA-r6ph-v2qm-q3c2"
        }
      ],
      "release_date": "2026-02-10T21:42:56.471000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-03T20:30:54+00:00",
          "details": "For Satellite MCP integration see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:f53ba238ef1d3373eaeae20953ea029affe3583e47f5e41e847d8ffbe9ca5217_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:22993"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:f53ba238ef1d3373eaeae20953ea029affe3583e47f5e41e847d8ffbe9ca5217_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:f53ba238ef1d3373eaeae20953ea029affe3583e47f5e41e847d8ffbe9ca5217_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves"
    },
    {
      "cve": "CVE-2026-34444",
      "cwe": {
        "id": "CWE-914",
        "name": "Improper Control of Dynamically-Identified Variables"
      },
      "discovery_date": "2026-04-06T16:02:58.221628+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2455413"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Lupa, a tool that integrates Lua or LuaJIT2 runtimes into CPython. An attacker can exploit this vulnerability by bypassing attribute filtering mechanisms when accessing attributes through built-in functions like `getattr` and `setattr`. This inconsistency in applying security restrictions can allow an attacker to execute arbitrary code, potentially compromising the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "lupa: Lupa: Arbitrary Code Execution due to inconsistent attribute filtering",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:f53ba238ef1d3373eaeae20953ea029affe3583e47f5e41e847d8ffbe9ca5217_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34444"
        },
        {
          "category": "external",
          "summary": "RHBZ#2455413",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455413"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34444",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34444"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34444",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34444"
        },
        {
          "category": "external",
          "summary": "https://github.com/scoder/lupa/security/advisories/GHSA-69v7-xpr6-6gjm",
          "url": "https://github.com/scoder/lupa/security/advisories/GHSA-69v7-xpr6-6gjm"
        }
      ],
      "release_date": "2026-04-06T15:30:30.525000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-03T20:30:54+00:00",
          "details": "For Satellite MCP integration see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:f53ba238ef1d3373eaeae20953ea029affe3583e47f5e41e847d8ffbe9ca5217_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:22993"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:f53ba238ef1d3373eaeae20953ea029affe3583e47f5e41e847d8ffbe9ca5217_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:f53ba238ef1d3373eaeae20953ea029affe3583e47f5e41e847d8ffbe9ca5217_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "lupa: Lupa: Arbitrary Code Execution due to inconsistent attribute filtering"
    },
    {
      "cve": "CVE-2026-48710",
      "cwe": {
        "id": "CWE-1289",
        "name": "Improper Validation of Unsafe Equivalence in Input"
      },
      "discovery_date": "2026-05-26T23:01:03.204374+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2481742"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Starlette, a lightweight ASGI (Asynchronous Server Gateway Interface) framework. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP `Host` request header. This malformed header could cause the `request.url` to be incorrectly reconstructed, leading to a discrepancy with the actual requested path. Consequently, security restrictions enforced by middleware and endpoints that rely on `request.url` for validation could be bypassed, potentially allowing unauthorized access or actions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "starlette: Starlette: Security restriction bypass via malformed HTTP Host header",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The impact is rated as Critical because path-based authentication and access control middleware can be completely bypassed by an unauthenticated remote attacker using a crafted HTTP Host header.\n\nStarlette reconstructs `request.url` by combining the HTTP Host header value with the request path, but performs no validation on the Host header. An attacker can inject path separators or query characters into the Host header (e.g., `Host: example.com/health?x=`), causing `request.url.path` to return a value that differs from the actual HTTP `request path` used for routing. Middleware that enforces authentication or authorization decisions based on `request.url.path` will evaluate the injected path rather than the real one, allowing the attacker to reach protected endpoints.\n\nWith regard to CVSS metrics, the Attack Vector (AV) is Network and Privileges Required (PR) is None, because the attack requires only the ability to send HTTP requests with a crafted Host header. User interaction is not required.\n\nRed Hat Satellite / Insights (IoP): The starlette package is included as a dependency of Connexion, but this flaw is rated Low impact because these services do not use path-based authentication middleware and all services are deployed behind reverse proxies. \n\nOpenShift Lightspeed (OLS): The starlette package is included as a dependency, but this flaw is rated Low impact because authentication is enforced via Kubernetes TokenReview/SubjectAccessReview through FastAPI dependency injection, not path-based middleware; request.url.path is only used for metrics and response header application.\n\nRHOAI Kubeflow Training images: starlette is being used as indirect dependency of mlflow, but this flaw is rated as Low impact because mlflow is used as client library only to store training metrics on remote server, it doesn\u0027t expose any endpoint.\n\nRHOAI odh-automl: The impact is reduced to Low since starlette is only used in the backend and it\u0027s transient dependency and starlette is not used at all to serve any endpoints.\n\nRHOAI odh-kserve-autogluon-server-rhel9: While the Starlette dependency is present in the build, the vulnerable code in starlette is not reachable. This reduces the impact to low.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:f53ba238ef1d3373eaeae20953ea029affe3583e47f5e41e847d8ffbe9ca5217_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48710"
        },
        {
          "category": "external",
          "summary": "RHBZ#2481742",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481742"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48710",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48710"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48710",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48710"
        },
        {
          "category": "external",
          "summary": "https://badhost.org",
          "url": "https://badhost.org"
        },
        {
          "category": "external",
          "summary": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6",
          "url": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6"
        },
        {
          "category": "external",
          "summary": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr",
          "url": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr"
        },
        {
          "category": "external",
          "summary": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml",
          "url": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml"
        },
        {
          "category": "external",
          "summary": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette",
          "url": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette"
        },
        {
          "category": "external",
          "summary": "https://www.secwest.net/starlette",
          "url": "https://www.secwest.net/starlette"
        },
        {
          "category": "external",
          "summary": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette",
          "url": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette"
        }
      ],
      "release_date": "2026-05-26T21:54:54.393000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-03T20:30:54+00:00",
          "details": "For Satellite MCP integration see the Red Hat Satellite documentation.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:f53ba238ef1d3373eaeae20953ea029affe3583e47f5e41e847d8ffbe9ca5217_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:22993"
        },
        {
          "category": "workaround",
          "details": "Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes.\n\nIf custom middleware is present, it should be updated to use `request.scope[\"path\"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target.",
          "product_ids": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:f53ba238ef1d3373eaeae20953ea029affe3583e47f5e41e847d8ffbe9ca5217_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Satellite 6.18:registry.redhat.io/satellite/foreman-mcp-server-rhel9@sha256:f53ba238ef1d3373eaeae20953ea029affe3583e47f5e41e847d8ffbe9ca5217_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "starlette: Starlette: Security restriction bypass via malformed HTTP Host header"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for Red Hat Ansible Automation Platform 2.7",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language.\n\nFor details about this release, refer to the release notes listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:23346",
        "url": "https://access.redhat.com/errata/RHSA-2026:23346"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-48710",
        "url": "https://access.redhat.com/security/cve/CVE-2026-48710"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.7/whats_new-async_updates",
        "url": "https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.7/whats_new-async_updates"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_23346.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.7 Container Release Update",
    "tracking": {
      "current_release_date": "2026-06-09T17:12:49+00:00",
      "generator": {
        "date": "2026-06-09T17:12:49+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.2"
        }
      },
      "id": "RHSA-2026:23346",
      "initial_release_date": "2026-06-04T14:20:50+00:00",
      "revision_history": [
        {
          "date": "2026-06-04T14:20:50+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-06-04T14:20:56+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-06-09T17:12:49+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Ansible Automation Platform 2.7",
                "product": {
                  "name": "Red Hat Ansible Automation Platform 2.7",
                  "product_id": "Red Hat Ansible Automation Platform 2.7",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:ansible_automation_platform:2.7::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Ansible Automation Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:0a2666977b025907e9bda427e52f813c63d1ac11cc44a84a897b6b9b2beed4f2_amd64",
                "product": {
                  "name": "registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:0a2666977b025907e9bda427e52f813c63d1ac11cc44a84a897b6b9b2beed4f2_amd64",
                  "product_id": "registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:0a2666977b025907e9bda427e52f813c63d1ac11cc44a84a897b6b9b2beed4f2_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/platform-operator-bundle@sha256%3A0a2666977b025907e9bda427e52f813c63d1ac11cc44a84a897b6b9b2beed4f2?arch=amd64\u0026repository_url=registry.redhat.io/ansible-automation-platform/platform-operator-bundle\u0026tag=1780540445"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:edbcc0735c66bb9d3ce66a5e6b632705cd62156db6bddc468597fb1d38bfc3a7_amd64",
                "product": {
                  "name": "registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:edbcc0735c66bb9d3ce66a5e6b632705cd62156db6bddc468597fb1d38bfc3a7_amd64",
                  "product_id": "registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:edbcc0735c66bb9d3ce66a5e6b632705cd62156db6bddc468597fb1d38bfc3a7_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/platform-operator-bundle@sha256%3Aedbcc0735c66bb9d3ce66a5e6b632705cd62156db6bddc468597fb1d38bfc3a7?arch=amd64\u0026repository_url=registry.redhat.io/ansible-automation-platform/platform-operator-bundle\u0026tag=1780540049"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:06177277bcfbd5914db291f5e20567e7f7d1b36448106f5a23e5d39f5e58efe5_amd64",
                "product": {
                  "name": "registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:06177277bcfbd5914db291f5e20567e7f7d1b36448106f5a23e5d39f5e58efe5_amd64",
                  "product_id": "registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:06177277bcfbd5914db291f5e20567e7f7d1b36448106f5a23e5d39f5e58efe5_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lightspeed-chatbot-rhel9@sha256%3A06177277bcfbd5914db291f5e20567e7f7d1b36448106f5a23e5d39f5e58efe5?arch=amd64\u0026repository_url=registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9\u0026tag=1780099185"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:548c0f6c5d1ab55981900654e471de3a0a754c756b8911c56db8a4771acafa08_amd64",
                "product": {
                  "name": "registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:548c0f6c5d1ab55981900654e471de3a0a754c756b8911c56db8a4771acafa08_amd64",
                  "product_id": "registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:548c0f6c5d1ab55981900654e471de3a0a754c756b8911c56db8a4771acafa08_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/hub-rhel9@sha256%3A548c0f6c5d1ab55981900654e471de3a0a754c756b8911c56db8a4771acafa08?arch=amd64\u0026repository_url=registry.redhat.io/ansible-automation-platform-27/hub-rhel9\u0026tag=1780534559"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:fe2c85706bc05aee376a230d559a25fab5170d1e459d785d06ad82dfb83298bb_arm64",
                "product": {
                  "name": "registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:fe2c85706bc05aee376a230d559a25fab5170d1e459d785d06ad82dfb83298bb_arm64",
                  "product_id": "registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:fe2c85706bc05aee376a230d559a25fab5170d1e459d785d06ad82dfb83298bb_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lightspeed-chatbot-rhel9@sha256%3Afe2c85706bc05aee376a230d559a25fab5170d1e459d785d06ad82dfb83298bb?arch=arm64\u0026repository_url=registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9\u0026tag=1780099185"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:0ed4b912faed4c0f14ff0482a86a2554ab8998a893d736098a1c9099bc06999b_arm64",
                "product": {
                  "name": "registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:0ed4b912faed4c0f14ff0482a86a2554ab8998a893d736098a1c9099bc06999b_arm64",
                  "product_id": "registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:0ed4b912faed4c0f14ff0482a86a2554ab8998a893d736098a1c9099bc06999b_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/hub-rhel9@sha256%3A0ed4b912faed4c0f14ff0482a86a2554ab8998a893d736098a1c9099bc06999b?arch=arm64\u0026repository_url=registry.redhat.io/ansible-automation-platform-27/hub-rhel9\u0026tag=1780534559"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:0ed4b912faed4c0f14ff0482a86a2554ab8998a893d736098a1c9099bc06999b_arm64 as a component of Red Hat Ansible Automation Platform 2.7",
          "product_id": "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:0ed4b912faed4c0f14ff0482a86a2554ab8998a893d736098a1c9099bc06999b_arm64"
        },
        "product_reference": "registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:0ed4b912faed4c0f14ff0482a86a2554ab8998a893d736098a1c9099bc06999b_arm64",
        "relates_to_product_reference": "Red Hat Ansible Automation Platform 2.7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:548c0f6c5d1ab55981900654e471de3a0a754c756b8911c56db8a4771acafa08_amd64 as a component of Red Hat Ansible Automation Platform 2.7",
          "product_id": "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:548c0f6c5d1ab55981900654e471de3a0a754c756b8911c56db8a4771acafa08_amd64"
        },
        "product_reference": "registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:548c0f6c5d1ab55981900654e471de3a0a754c756b8911c56db8a4771acafa08_amd64",
        "relates_to_product_reference": "Red Hat Ansible Automation Platform 2.7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:06177277bcfbd5914db291f5e20567e7f7d1b36448106f5a23e5d39f5e58efe5_amd64 as a component of Red Hat Ansible Automation Platform 2.7",
          "product_id": "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:06177277bcfbd5914db291f5e20567e7f7d1b36448106f5a23e5d39f5e58efe5_amd64"
        },
        "product_reference": "registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:06177277bcfbd5914db291f5e20567e7f7d1b36448106f5a23e5d39f5e58efe5_amd64",
        "relates_to_product_reference": "Red Hat Ansible Automation Platform 2.7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:fe2c85706bc05aee376a230d559a25fab5170d1e459d785d06ad82dfb83298bb_arm64 as a component of Red Hat Ansible Automation Platform 2.7",
          "product_id": "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:fe2c85706bc05aee376a230d559a25fab5170d1e459d785d06ad82dfb83298bb_arm64"
        },
        "product_reference": "registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:fe2c85706bc05aee376a230d559a25fab5170d1e459d785d06ad82dfb83298bb_arm64",
        "relates_to_product_reference": "Red Hat Ansible Automation Platform 2.7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:0a2666977b025907e9bda427e52f813c63d1ac11cc44a84a897b6b9b2beed4f2_amd64 as a component of Red Hat Ansible Automation Platform 2.7",
          "product_id": "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:0a2666977b025907e9bda427e52f813c63d1ac11cc44a84a897b6b9b2beed4f2_amd64"
        },
        "product_reference": "registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:0a2666977b025907e9bda427e52f813c63d1ac11cc44a84a897b6b9b2beed4f2_amd64",
        "relates_to_product_reference": "Red Hat Ansible Automation Platform 2.7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:edbcc0735c66bb9d3ce66a5e6b632705cd62156db6bddc468597fb1d38bfc3a7_amd64 as a component of Red Hat Ansible Automation Platform 2.7",
          "product_id": "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:edbcc0735c66bb9d3ce66a5e6b632705cd62156db6bddc468597fb1d38bfc3a7_amd64"
        },
        "product_reference": "registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:edbcc0735c66bb9d3ce66a5e6b632705cd62156db6bddc468597fb1d38bfc3a7_amd64",
        "relates_to_product_reference": "Red Hat Ansible Automation Platform 2.7"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-48710",
      "cwe": {
        "id": "CWE-1289",
        "name": "Improper Validation of Unsafe Equivalence in Input"
      },
      "discovery_date": "2026-05-26T23:01:03.204374+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:0ed4b912faed4c0f14ff0482a86a2554ab8998a893d736098a1c9099bc06999b_arm64",
            "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:548c0f6c5d1ab55981900654e471de3a0a754c756b8911c56db8a4771acafa08_amd64",
            "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:0a2666977b025907e9bda427e52f813c63d1ac11cc44a84a897b6b9b2beed4f2_amd64",
            "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:edbcc0735c66bb9d3ce66a5e6b632705cd62156db6bddc468597fb1d38bfc3a7_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2481742"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Starlette, a lightweight ASGI (Asynchronous Server Gateway Interface) framework. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP `Host` request header. This malformed header could cause the `request.url` to be incorrectly reconstructed, leading to a discrepancy with the actual requested path. Consequently, security restrictions enforced by middleware and endpoints that rely on `request.url` for validation could be bypassed, potentially allowing unauthorized access or actions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "starlette: Starlette: Security restriction bypass via malformed HTTP Host header",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The impact is rated as Critical because path-based authentication and access control middleware can be completely bypassed by an unauthenticated remote attacker using a crafted HTTP Host header.\n\nStarlette reconstructs `request.url` by combining the HTTP Host header value with the request path, but performs no validation on the Host header. An attacker can inject path separators or query characters into the Host header (e.g., `Host: example.com/health?x=`), causing `request.url.path` to return a value that differs from the actual HTTP `request path` used for routing. Middleware that enforces authentication or authorization decisions based on `request.url.path` will evaluate the injected path rather than the real one, allowing the attacker to reach protected endpoints.\n\nWith regard to CVSS metrics, the Attack Vector (AV) is Network and Privileges Required (PR) is None, because the attack requires only the ability to send HTTP requests with a crafted Host header. User interaction is not required.\n\nRed Hat Satellite / Insights (IoP): The starlette package is included as a dependency of Connexion, but this flaw is rated Low impact because these services do not use path-based authentication middleware and all services are deployed behind reverse proxies. \n\nOpenShift Lightspeed (OLS): The starlette package is included as a dependency, but this flaw is rated Low impact because authentication is enforced via Kubernetes TokenReview/SubjectAccessReview through FastAPI dependency injection, not path-based middleware; request.url.path is only used for metrics and response header application.\n\nRHOAI Kubeflow Training images: starlette is being used as indirect dependency of mlflow, but this flaw is rated as Low impact because mlflow is used as client library only to store training metrics on remote server, it doesn\u0027t expose any endpoint.\n\nRHOAI odh-automl: The impact is reduced to Low since starlette is only used in the backend and it\u0027s transient dependency and starlette is not used at all to serve any endpoints.\n\nRHOAI odh-kserve-autogluon-server-rhel9: While the Starlette dependency is present in the build, the vulnerable code in starlette is not reachable. This reduces the impact to low.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:06177277bcfbd5914db291f5e20567e7f7d1b36448106f5a23e5d39f5e58efe5_amd64",
          "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:fe2c85706bc05aee376a230d559a25fab5170d1e459d785d06ad82dfb83298bb_arm64"
        ],
        "known_not_affected": [
          "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:0ed4b912faed4c0f14ff0482a86a2554ab8998a893d736098a1c9099bc06999b_arm64",
          "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:548c0f6c5d1ab55981900654e471de3a0a754c756b8911c56db8a4771acafa08_amd64",
          "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:0a2666977b025907e9bda427e52f813c63d1ac11cc44a84a897b6b9b2beed4f2_amd64",
          "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:edbcc0735c66bb9d3ce66a5e6b632705cd62156db6bddc468597fb1d38bfc3a7_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48710"
        },
        {
          "category": "external",
          "summary": "RHBZ#2481742",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481742"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48710",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48710"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48710",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48710"
        },
        {
          "category": "external",
          "summary": "https://badhost.org",
          "url": "https://badhost.org"
        },
        {
          "category": "external",
          "summary": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6",
          "url": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6"
        },
        {
          "category": "external",
          "summary": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr",
          "url": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr"
        },
        {
          "category": "external",
          "summary": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml",
          "url": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml"
        },
        {
          "category": "external",
          "summary": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette",
          "url": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette"
        },
        {
          "category": "external",
          "summary": "https://www.secwest.net/starlette",
          "url": "https://www.secwest.net/starlette"
        },
        {
          "category": "external",
          "summary": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette",
          "url": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette"
        }
      ],
      "release_date": "2026-05-26T21:54:54.393000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-04T14:20:50+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.7#Upgrade",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:06177277bcfbd5914db291f5e20567e7f7d1b36448106f5a23e5d39f5e58efe5_amd64",
            "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:fe2c85706bc05aee376a230d559a25fab5170d1e459d785d06ad82dfb83298bb_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:23346"
        },
        {
          "category": "workaround",
          "details": "Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes.\n\nIf custom middleware is present, it should be updated to use `request.scope[\"path\"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target.",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:0ed4b912faed4c0f14ff0482a86a2554ab8998a893d736098a1c9099bc06999b_arm64",
            "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:548c0f6c5d1ab55981900654e471de3a0a754c756b8911c56db8a4771acafa08_amd64",
            "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:06177277bcfbd5914db291f5e20567e7f7d1b36448106f5a23e5d39f5e58efe5_amd64",
            "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:fe2c85706bc05aee376a230d559a25fab5170d1e459d785d06ad82dfb83298bb_arm64",
            "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:0a2666977b025907e9bda427e52f813c63d1ac11cc44a84a897b6b9b2beed4f2_amd64",
            "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:edbcc0735c66bb9d3ce66a5e6b632705cd62156db6bddc468597fb1d38bfc3a7_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:0ed4b912faed4c0f14ff0482a86a2554ab8998a893d736098a1c9099bc06999b_arm64",
            "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:548c0f6c5d1ab55981900654e471de3a0a754c756b8911c56db8a4771acafa08_amd64",
            "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:06177277bcfbd5914db291f5e20567e7f7d1b36448106f5a23e5d39f5e58efe5_amd64",
            "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:fe2c85706bc05aee376a230d559a25fab5170d1e459d785d06ad82dfb83298bb_arm64",
            "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:0a2666977b025907e9bda427e52f813c63d1ac11cc44a84a897b6b9b2beed4f2_amd64",
            "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:edbcc0735c66bb9d3ce66a5e6b632705cd62156db6bddc468597fb1d38bfc3a7_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "starlette: Starlette: Security restriction bypass via malformed HTTP Host header"
    }
  ]
}