RHSA-2026:23346
Vulnerability from csaf_redhat - Published: 2026-06-04 14:20 - Updated: 2026-06-16 21:44Summary
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.7 Container Release Update
Severity
Critical
Notes
Topic: An update is now available for Red Hat Ansible Automation Platform 2.7
Details: Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language.
For details about this release, refer to the release notes listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Starlette, a lightweight ASGI (Asynchronous Server Gateway Interface) framework. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP `Host` request header. This malformed header could cause the `request.url` to be incorrectly reconstructed, leading to a discrepancy with the actual requested path. Consequently, security restrictions enforced by middleware and endpoints that rely on `request.url` for validation could be bypassed, potentially allowing unauthorized access or actions.
6.5 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:06177277bcfbd5914db291f5e20567e7f7d1b36448106f5a23e5d39f5e58efe5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:fe2c85706bc05aee376a230d559a25fab5170d1e459d785d06ad82dfb83298bb_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:0ed4b912faed4c0f14ff0482a86a2554ab8998a893d736098a1c9099bc06999b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:548c0f6c5d1ab55981900654e471de3a0a754c756b8911c56db8a4771acafa08_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:0a2666977b025907e9bda427e52f813c63d1ac11cc44a84a897b6b9b2beed4f2_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:edbcc0735c66bb9d3ce66a5e6b632705cd62156db6bddc468597fb1d38bfc3a7_amd64 | — |
Workaround
|
Threats
Impact
Critical
References
16 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat Ansible Automation Platform 2.7",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language.\n\nFor details about this release, refer to the release notes listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:23346",
"url": "https://access.redhat.com/errata/RHSA-2026:23346"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-48710",
"url": "https://access.redhat.com/security/cve/CVE-2026-48710"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.7/whats_new-async_updates",
"url": "https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.7/whats_new-async_updates"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_23346.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.7 Container Release Update",
"tracking": {
"current_release_date": "2026-06-16T21:44:22+00:00",
"generator": {
"date": "2026-06-16T21:44:22+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.0.0"
}
},
"id": "RHSA-2026:23346",
"initial_release_date": "2026-06-04T14:20:50+00:00",
"revision_history": [
{
"date": "2026-06-04T14:20:50+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-06-04T14:20:56+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-06-16T21:44:22+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Ansible Automation Platform 2.7",
"product": {
"name": "Red Hat Ansible Automation Platform 2.7",
"product_id": "Red Hat Ansible Automation Platform 2.7",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ansible_automation_platform:2.7::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Ansible Automation Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:0a2666977b025907e9bda427e52f813c63d1ac11cc44a84a897b6b9b2beed4f2_amd64",
"product": {
"name": "registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:0a2666977b025907e9bda427e52f813c63d1ac11cc44a84a897b6b9b2beed4f2_amd64",
"product_id": "registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:0a2666977b025907e9bda427e52f813c63d1ac11cc44a84a897b6b9b2beed4f2_amd64",
"product_identification_helper": {
"purl": "pkg:oci/platform-operator-bundle@sha256%3A0a2666977b025907e9bda427e52f813c63d1ac11cc44a84a897b6b9b2beed4f2?arch=amd64\u0026repository_url=registry.redhat.io/ansible-automation-platform/platform-operator-bundle\u0026tag=1780540445"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:edbcc0735c66bb9d3ce66a5e6b632705cd62156db6bddc468597fb1d38bfc3a7_amd64",
"product": {
"name": "registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:edbcc0735c66bb9d3ce66a5e6b632705cd62156db6bddc468597fb1d38bfc3a7_amd64",
"product_id": "registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:edbcc0735c66bb9d3ce66a5e6b632705cd62156db6bddc468597fb1d38bfc3a7_amd64",
"product_identification_helper": {
"purl": "pkg:oci/platform-operator-bundle@sha256%3Aedbcc0735c66bb9d3ce66a5e6b632705cd62156db6bddc468597fb1d38bfc3a7?arch=amd64\u0026repository_url=registry.redhat.io/ansible-automation-platform/platform-operator-bundle\u0026tag=1780540049"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:06177277bcfbd5914db291f5e20567e7f7d1b36448106f5a23e5d39f5e58efe5_amd64",
"product": {
"name": "registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:06177277bcfbd5914db291f5e20567e7f7d1b36448106f5a23e5d39f5e58efe5_amd64",
"product_id": "registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:06177277bcfbd5914db291f5e20567e7f7d1b36448106f5a23e5d39f5e58efe5_amd64",
"product_identification_helper": {
"purl": "pkg:oci/lightspeed-chatbot-rhel9@sha256%3A06177277bcfbd5914db291f5e20567e7f7d1b36448106f5a23e5d39f5e58efe5?arch=amd64\u0026repository_url=registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9\u0026tag=1780099185"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:548c0f6c5d1ab55981900654e471de3a0a754c756b8911c56db8a4771acafa08_amd64",
"product": {
"name": "registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:548c0f6c5d1ab55981900654e471de3a0a754c756b8911c56db8a4771acafa08_amd64",
"product_id": "registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:548c0f6c5d1ab55981900654e471de3a0a754c756b8911c56db8a4771acafa08_amd64",
"product_identification_helper": {
"purl": "pkg:oci/hub-rhel9@sha256%3A548c0f6c5d1ab55981900654e471de3a0a754c756b8911c56db8a4771acafa08?arch=amd64\u0026repository_url=registry.redhat.io/ansible-automation-platform-27/hub-rhel9\u0026tag=1780534559"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:fe2c85706bc05aee376a230d559a25fab5170d1e459d785d06ad82dfb83298bb_arm64",
"product": {
"name": "registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:fe2c85706bc05aee376a230d559a25fab5170d1e459d785d06ad82dfb83298bb_arm64",
"product_id": "registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:fe2c85706bc05aee376a230d559a25fab5170d1e459d785d06ad82dfb83298bb_arm64",
"product_identification_helper": {
"purl": "pkg:oci/lightspeed-chatbot-rhel9@sha256%3Afe2c85706bc05aee376a230d559a25fab5170d1e459d785d06ad82dfb83298bb?arch=arm64\u0026repository_url=registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9\u0026tag=1780099185"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:0ed4b912faed4c0f14ff0482a86a2554ab8998a893d736098a1c9099bc06999b_arm64",
"product": {
"name": "registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:0ed4b912faed4c0f14ff0482a86a2554ab8998a893d736098a1c9099bc06999b_arm64",
"product_id": "registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:0ed4b912faed4c0f14ff0482a86a2554ab8998a893d736098a1c9099bc06999b_arm64",
"product_identification_helper": {
"purl": "pkg:oci/hub-rhel9@sha256%3A0ed4b912faed4c0f14ff0482a86a2554ab8998a893d736098a1c9099bc06999b?arch=arm64\u0026repository_url=registry.redhat.io/ansible-automation-platform-27/hub-rhel9\u0026tag=1780534559"
}
}
}
],
"category": "architecture",
"name": "arm64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:0ed4b912faed4c0f14ff0482a86a2554ab8998a893d736098a1c9099bc06999b_arm64 as a component of Red Hat Ansible Automation Platform 2.7",
"product_id": "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:0ed4b912faed4c0f14ff0482a86a2554ab8998a893d736098a1c9099bc06999b_arm64"
},
"product_reference": "registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:0ed4b912faed4c0f14ff0482a86a2554ab8998a893d736098a1c9099bc06999b_arm64",
"relates_to_product_reference": "Red Hat Ansible Automation Platform 2.7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:548c0f6c5d1ab55981900654e471de3a0a754c756b8911c56db8a4771acafa08_amd64 as a component of Red Hat Ansible Automation Platform 2.7",
"product_id": "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:548c0f6c5d1ab55981900654e471de3a0a754c756b8911c56db8a4771acafa08_amd64"
},
"product_reference": "registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:548c0f6c5d1ab55981900654e471de3a0a754c756b8911c56db8a4771acafa08_amd64",
"relates_to_product_reference": "Red Hat Ansible Automation Platform 2.7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:06177277bcfbd5914db291f5e20567e7f7d1b36448106f5a23e5d39f5e58efe5_amd64 as a component of Red Hat Ansible Automation Platform 2.7",
"product_id": "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:06177277bcfbd5914db291f5e20567e7f7d1b36448106f5a23e5d39f5e58efe5_amd64"
},
"product_reference": "registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:06177277bcfbd5914db291f5e20567e7f7d1b36448106f5a23e5d39f5e58efe5_amd64",
"relates_to_product_reference": "Red Hat Ansible Automation Platform 2.7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:fe2c85706bc05aee376a230d559a25fab5170d1e459d785d06ad82dfb83298bb_arm64 as a component of Red Hat Ansible Automation Platform 2.7",
"product_id": "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:fe2c85706bc05aee376a230d559a25fab5170d1e459d785d06ad82dfb83298bb_arm64"
},
"product_reference": "registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:fe2c85706bc05aee376a230d559a25fab5170d1e459d785d06ad82dfb83298bb_arm64",
"relates_to_product_reference": "Red Hat Ansible Automation Platform 2.7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:0a2666977b025907e9bda427e52f813c63d1ac11cc44a84a897b6b9b2beed4f2_amd64 as a component of Red Hat Ansible Automation Platform 2.7",
"product_id": "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:0a2666977b025907e9bda427e52f813c63d1ac11cc44a84a897b6b9b2beed4f2_amd64"
},
"product_reference": "registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:0a2666977b025907e9bda427e52f813c63d1ac11cc44a84a897b6b9b2beed4f2_amd64",
"relates_to_product_reference": "Red Hat Ansible Automation Platform 2.7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:edbcc0735c66bb9d3ce66a5e6b632705cd62156db6bddc468597fb1d38bfc3a7_amd64 as a component of Red Hat Ansible Automation Platform 2.7",
"product_id": "Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:edbcc0735c66bb9d3ce66a5e6b632705cd62156db6bddc468597fb1d38bfc3a7_amd64"
},
"product_reference": "registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:edbcc0735c66bb9d3ce66a5e6b632705cd62156db6bddc468597fb1d38bfc3a7_amd64",
"relates_to_product_reference": "Red Hat Ansible Automation Platform 2.7"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-48710",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-05-26T23:01:03.204374+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:0ed4b912faed4c0f14ff0482a86a2554ab8998a893d736098a1c9099bc06999b_arm64",
"Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:548c0f6c5d1ab55981900654e471de3a0a754c756b8911c56db8a4771acafa08_amd64",
"Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:0a2666977b025907e9bda427e52f813c63d1ac11cc44a84a897b6b9b2beed4f2_amd64",
"Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:edbcc0735c66bb9d3ce66a5e6b632705cd62156db6bddc468597fb1d38bfc3a7_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2481742"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Starlette, a lightweight ASGI (Asynchronous Server Gateway Interface) framework. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP `Host` request header. This malformed header could cause the `request.url` to be incorrectly reconstructed, leading to a discrepancy with the actual requested path. Consequently, security restrictions enforced by middleware and endpoints that rely on `request.url` for validation could be bypassed, potentially allowing unauthorized access or actions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "starlette: Starlette: Security restriction bypass via malformed HTTP Host header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The impact is rated as Critical because path-based authentication and access control middleware can be completely bypassed by an unauthenticated remote attacker using a crafted HTTP Host header.\n\nStarlette reconstructs `request.url` by combining the HTTP Host header value with the request path, but performs no validation on the Host header. An attacker can inject path separators or query characters into the Host header (e.g., `Host: example.com/health?x=`), causing `request.url.path` to return a value that differs from the actual HTTP `request path` used for routing. Middleware that enforces authentication or authorization decisions based on `request.url.path` will evaluate the injected path rather than the real one, allowing the attacker to reach protected endpoints.\n\nWith regard to CVSS metrics, the Attack Vector (AV) is Network and Privileges Required (PR) is None, because the attack requires only the ability to send HTTP requests with a crafted Host header. User interaction is not required.\n\nRed Hat Satellite / Insights (IoP): The starlette package is included as a dependency of Connexion, but this flaw is rated Low impact because these services do not use path-based authentication middleware and all services are deployed behind reverse proxies. \n\nOpenShift Lightspeed (OLS): The starlette package is included as a dependency, but this flaw is rated Low impact because authentication is enforced via Kubernetes TokenReview/SubjectAccessReview through FastAPI dependency injection, not path-based middleware; request.url.path is only used for metrics and response header application.\n\nRHOAI Kubeflow Training images: starlette is being used as indirect dependency of mlflow, but this flaw is rated as Low impact because mlflow is used as client library only to store training metrics on remote server, it doesn\u0027t expose any endpoint.\n\nRHOAI odh-automl: The impact is reduced to Low since starlette is only used in the backend and it\u0027s transient dependency and starlette is not used at all to serve any endpoints.\n\nRHOAI odh-kserve-autogluon-server-rhel9: While the Starlette dependency is present in the build, the vulnerable code in starlette is not reachable. This reduces the impact to low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:06177277bcfbd5914db291f5e20567e7f7d1b36448106f5a23e5d39f5e58efe5_amd64",
"Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:fe2c85706bc05aee376a230d559a25fab5170d1e459d785d06ad82dfb83298bb_arm64"
],
"known_not_affected": [
"Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:0ed4b912faed4c0f14ff0482a86a2554ab8998a893d736098a1c9099bc06999b_arm64",
"Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:548c0f6c5d1ab55981900654e471de3a0a754c756b8911c56db8a4771acafa08_amd64",
"Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:0a2666977b025907e9bda427e52f813c63d1ac11cc44a84a897b6b9b2beed4f2_amd64",
"Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:edbcc0735c66bb9d3ce66a5e6b632705cd62156db6bddc468597fb1d38bfc3a7_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48710"
},
{
"category": "external",
"summary": "RHBZ#2481742",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481742"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48710",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48710"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48710",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48710"
},
{
"category": "external",
"summary": "https://badhost.org",
"url": "https://badhost.org"
},
{
"category": "external",
"summary": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6",
"url": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6"
},
{
"category": "external",
"summary": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr",
"url": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr"
},
{
"category": "external",
"summary": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml"
},
{
"category": "external",
"summary": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette",
"url": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette"
},
{
"category": "external",
"summary": "https://www.secwest.net/starlette",
"url": "https://www.secwest.net/starlette"
},
{
"category": "external",
"summary": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette",
"url": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette"
}
],
"release_date": "2026-05-26T21:54:54.393000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:20:50+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.7#Upgrade",
"product_ids": [
"Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:06177277bcfbd5914db291f5e20567e7f7d1b36448106f5a23e5d39f5e58efe5_amd64",
"Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:fe2c85706bc05aee376a230d559a25fab5170d1e459d785d06ad82dfb83298bb_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23346"
},
{
"category": "workaround",
"details": "Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes.\n\nIf custom middleware is present, it should be updated to use `request.scope[\"path\"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:0ed4b912faed4c0f14ff0482a86a2554ab8998a893d736098a1c9099bc06999b_arm64",
"Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:548c0f6c5d1ab55981900654e471de3a0a754c756b8911c56db8a4771acafa08_amd64",
"Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:06177277bcfbd5914db291f5e20567e7f7d1b36448106f5a23e5d39f5e58efe5_amd64",
"Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:fe2c85706bc05aee376a230d559a25fab5170d1e459d785d06ad82dfb83298bb_arm64",
"Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:0a2666977b025907e9bda427e52f813c63d1ac11cc44a84a897b6b9b2beed4f2_amd64",
"Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:edbcc0735c66bb9d3ce66a5e6b632705cd62156db6bddc468597fb1d38bfc3a7_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:0ed4b912faed4c0f14ff0482a86a2554ab8998a893d736098a1c9099bc06999b_arm64",
"Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:548c0f6c5d1ab55981900654e471de3a0a754c756b8911c56db8a4771acafa08_amd64",
"Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:06177277bcfbd5914db291f5e20567e7f7d1b36448106f5a23e5d39f5e58efe5_amd64",
"Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:fe2c85706bc05aee376a230d559a25fab5170d1e459d785d06ad82dfb83298bb_arm64",
"Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:0a2666977b025907e9bda427e52f813c63d1ac11cc44a84a897b6b9b2beed4f2_amd64",
"Red Hat Ansible Automation Platform 2.7:registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:edbcc0735c66bb9d3ce66a5e6b632705cd62156db6bddc468597fb1d38bfc3a7_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "starlette: Starlette: Security restriction bypass via malformed HTTP Host header"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…