StackRadar

CVE-2026-48710

MediumKEV

Advisory

Published 22 May 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.363
98th percentile
CISA KEV
Listed
since 2 Sept 2026
Charts affected
141
of 17,781 indexed, latest versions
Container images
172
deployed by those charts
Fix available
1 of 1
affected package

Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

Carried by container images the latest versions of 141 of 17,781 indexed charts deploy, on 172 images.

Affected packageAffected versionsFixed inImages
starlettepypi0.13.6, 0.13.8, 0.14.1, 0.14.2+30 more1.0.1172
OSV records
GHSA-86qp-5c8j-p5mr
Also known as
PYSEC-2026-161, X41-2026-002

Charts affected

141 by stars
ChartLatestAffected imagesRadar Score
dummy-servicephanVerified publisher0.3.41 of 1See more

dummy-service phan 0.3.4

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
phan2410/dummy-service:0.0.89c6ed6de26ca
starlette@0.40.0
1.0.1

Open the chart page →

5,706
phronetisphronetis0.1.271 of 2See more

phronetis phronetis 0.1.27

1 of the 2 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
knspar/phronetis:0.1.4609499d2dc91a
starlette@0.46.2
1.0.1

Open the chart page →

16,196
prompt-dbprompt-dbVerified publisher1.0.71 of 3See more

prompt-db prompt-db 1.0.7

1 of the 3 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/erlkoenig91/prompt-db-backend:1.0.7ab120359810d
starlette@0.41.3
1.0.1

Open the chart page →

3,332
python-fastapi-postgrespython-fastapi-postgres0.1.01 of 1See more

python-fastapi-postgres python-fastapi-postgres 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
archish27/python-fastapi-postgres:latest6610071a2101
starlette@0.19.1
1.0.1

Open the chart page →

2,983
helm-redchefredchef0.1.01 of 3See more

helm-redchef redchef 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
sharanalwar/redchef-backend:latest8d3cab80df49
starlette@0.27.0
1.0.1

Open the chart page →

4,763
request-registryrequest-registry0.1.01 of 2See more

request-registry request-registry 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
registry.gitlab.com/open-forms/request-registry:latest0886cbbc5f95
starlette@0.14.2
1.0.1

Open the chart page →

2,201
esphomeretsamedocVerified publisher2026.2.51 of 1See more

esphome retsamedoc 2026.2.5

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
esphome/esphome:2024.3.09ab8cc88b28c
starlette@0.35.1
1.0.1

Open the chart page →

7,431
rhbk-neurofacerhbk-neurofaceVerified publisher1.0.01 of 4See more

rhbk-neuroface rhbk-neuroface 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/neuroface-backend:latestcba71dc08c8a
starlette@0.41.3
1.0.1

Open the chart page →

3,781
ai-agentromholdings0.0.11 of 1See more

ai-agent romholdings 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
starlette@0.40.0
1.0.1

Open the chart page →

9,607
imgtagrotationalVerified publisher0.2.01 of 1See more

imgtag rotational 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
gcr.io/rotationalio-habanero/imgtag:89ec287a534a3170d03
starlette@0.37.2
1.0.1

Open the chart page →

3,312
agentdatarss30.1.01 of 1See more

agentdata rss3 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
starlette@0.36.3
1.0.1

Open the chart page →

3,512
noderss30.7.21 of 3See more

node rss3 0.7.2

1 of the 3 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
starlette@0.36.3
1.0.1

Open the chart page →

4,718
checkmkrtomik-helm-chartsVerified publisher0.1.01 of 1See more

checkmk rtomik-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
checkmk/check-mk-community:2.5.0p6c11b422210c4
starlette@0.50.0
1.0.1

Open the chart page →

7,436
runwhen-localrunwhen-contribVerified publisher0.6.171 of 3See more

runwhen-local runwhen-contrib 0.6.17

1 of the 3 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/runwhen-contrib/runwhen-local:0.12.0533ce58c6e02
starlette@0.46.2
1.0.1

Open the chart page →

3,707
test-helm-app1saam-helm-test0.1.01 of 1See more

test-helm-app1 saam-helm-test 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
hamidyousefi93/saam-test:latestc34f071f6ed0
starlette@0.27.0
1.0.1

Open the chart page →

3,887
test-helm-app2saam-helm-test0.1.01 of 1See more

test-helm-app2 saam-helm-test 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
asdkant/fastapi-hello-world:latesta23d8bf7c885
starlette@0.14.2
1.0.1

Open the chart page →

2,770
showroom-docs-mcpshowroom-docs-mcpVerified publisher2.1.01 of 4See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
litellm/litellm-non_root:v1.82.3-stable09b217802ded
starlette@0.49.1
1.0.1

Open the chart page →

5,201
mealiesmarthallVerified publisher0.0.101 of 1See more

mealie smarthall 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
starlette@0.37.2
1.0.1

Open the chart page →

5,565
srebotsrebot0.14.01 of 2See more

srebot srebot 0.14.0

1 of the 2 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/shadrus/srebot:0.14.09b4415e937b2
starlette@0.52.1
1.0.1

Open the chart page →

1,542
horcruxstakewise1.0.11 of 1See more

horcrux stakewise 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
stakewiselabs/bls-horcrux:v1.0.02afd0c0b34cb
starlette@0.13.6
1.0.1

Open the chart page →

1,421
verbasubstratusVerified publisher0.4.01 of 1See more

verba substratus 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
substratusai/verba:v0.4.0-baseURL261695be635eb
starlette@0.27.0
1.0.1

Open the chart page →

13,390
surogate-hubsurogate-hubVerified publisher2.1.51 of 1See more

surogate-hub surogate-hub 2.1.5

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
starlette@1.0.0
1.0.1

Open the chart page →

3,460
take-the-helmtake-the-helm0.1.01 of 1See more

take-the-helm take-the-helm 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
cadmusthefounder/lnd:take-the-helm-0.1.0e596c5fbf80f
starlette@0.19.1
1.0.1

Open the chart page →

805
tarkatarkaOfficialVerified publisher0.4.11 of 4See more

tarka tarka 0.4.1

1 of the 4 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/tarkyaio/tarka:0.4.1e8d3f1512f06
starlette@0.52.1
1.0.1

Open the chart page →

1,556
asrtest-opea1.0.01 of 1See more

asr test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/asr:1.025dd26d9cd09
starlette@0.38.5
1.0.1

Open the chart page →

4,393
chatqnatest-opea1.0.05 of 11See more

chatqna test-opea 1.0.0

5 of the 11 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/chatqna:1.038c51b791efa
starlette@0.38.5
1.0.1
opea/embedding-tei:1.05c9639de61c1
starlette@0.38.5
1.0.1
opea/llm-tgi:1.00c25aab3f106
starlette@0.38.5
1.0.1
opea/reranking-tei:1.0e48613afb191
starlette@0.38.5
1.0.1
opea/retriever-redis:1.0eb746b263705
starlette@0.38.5
1.0.1

Open the chart page →

39,090
codegentest-opea1.0.02 of 5See more

codegen test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/codegen:1.058f91683892d
starlette@0.38.5
1.0.1
opea/llm-tgi:1.00c25aab3f106
starlette@0.38.5
1.0.1

Open the chart page →

28,814
codetranstest-opea1.0.02 of 5See more

codetrans test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/codetrans:1.0e2436483b73d
starlette@0.38.5
1.0.1
opea/llm-tgi:1.00c25aab3f106
starlette@0.38.5
1.0.1

Open the chart page →

28,385
docsumtest-opea1.0.02 of 5See more

docsum test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/docsum:1.03eaa91849512
starlette@0.38.5
1.0.1
opea/llm-docsum-tgi:1.002f9e8fa5d71
starlette@0.38.5
1.0.1

Open the chart page →

28,858
embedding-usvctest-opea1.0.01 of 1See more

embedding-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/embedding-tei:1.05c9639de61c1
starlette@0.38.5
1.0.1

Open the chart page →

5,185
guardrails-usvctest-opea1.0.01 of 1See more

guardrails-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/guardrails-tgi:1.0262c6048aab8
starlette@0.38.5
1.0.1

Open the chart page →

5,221
llm-uservicetest-opea1.0.01 of 1See more

llm-uservice test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/llm-tgi:1.00c25aab3f106
starlette@0.38.5
1.0.1

Open the chart page →

4,720
reranking-usvctest-opea1.0.01 of 1See more

reranking-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/reranking-tei:1.0e48613afb191
starlette@0.38.5
1.0.1

Open the chart page →

4,985
retriever-usvctest-opea1.0.01 of 1See more

retriever-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/retriever-redis:1.0eb746b263705
starlette@0.38.5
1.0.1

Open the chart page →

5,198
speecht5test-opea1.0.01 of 1See more

speecht5 test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/speecht5:1.0249afad3d268
starlette@0.38.5
1.0.1

Open the chart page →

9,616
ttstest-opea1.0.01 of 1See more

tts test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/tts:1.0257ae94709e9
starlette@0.38.5
1.0.1

Open the chart page →

4,377
web-retrievertest-opea1.0.01 of 1See more

web-retriever test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/web-retriever-chroma:1.0fe08165d7770
starlette@0.38.5
1.0.1

Open the chart page →

5,350
kasa-exporterth-chartsVerified publisher0.1.01 of 1See more

kasa-exporter th-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
thelande/kasa_exporter:v0.2.3a1fdb8baa152
starlette@0.37.2
1.0.1

Open the chart page →

1,515
tfy-grafanatruefoundryVerified publisher0.1.211 of 3See more

tfy-grafana truefoundry 0.1.21

1 of the 3 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.1.2716b0b33ff2d
starlette@0.49.3
1.0.1

Open the chart page →

1,062
truefoundry-monitoringtruefoundryVerified publisher0.1.61 of 8See more

truefoundry-monitoring truefoundry 0.1.6

1 of the 8 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.1.2716b0b33ff2d
starlette@0.49.3
1.0.1

Open the chart page →

4,526
wazuhwazuh-helm-eksVerified publisher1.2.101 of 6See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.14.45a065930682d
starlette@0.49.1
1.0.1

Open the chart page →

5,484

Container images carrying it

172 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
tock/gen-ai-orchestrator-server:25.10.7abf7880e0449
starlette@0.46.2
1.0.1
1
wazuh/wazuh-manager:4.11.11da5c38c6a78
starlette@0.39.2
1.0.1
1
wazuh/wazuh-manager:4.14.45a065930682d
starlette@0.49.1
1.0.1
1
wazuh/wazuh-manager:4.14.3f09282d281f6
starlette@0.49.1
1.0.1
1
witcherek7/pav:0.0.342a744f29ac0
starlette@0.22.0
1.0.1
1
yetiplatform/yeti:2.9.09bcbe2650a14
starlette@0.46.2
1.0.1
1
yetiplatform/yeti:latest9c3006cedcca
starlette@0.46.2
1.0.1
1
zepai/knowledge-graph-mcp:v0.2.16ab0ee79926b
starlette@0.47.1
1.0.1
1
zurdi15/romm:2.3.12db88fe44c89
starlette@0.27.0
1.0.1
1
gcr.io/rotationalio-habanero/imgtag:89ec287a534a3170d03
starlette@0.37.2
1.0.1
1
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
starlette@0.41.3
1.0.1
1
ghcr.io/colenio/slo-reporting:0.3.316b64d194a27d
starlette@0.41.3
1.0.1
1
ghcr.io/danny-avila/librechat-rag-api-dev-lite:latestf9f34c8ed688
starlette@0.46.2
1.0.1
1
ghcr.io/developmentseed/titiler:0.22.48ac53eb38393
starlette@0.46.2
1.0.1
1
ghcr.io/dodevops/azure-app-exporter/azure-app-exporter:0.1.38b472877847f5
starlette@0.17.1
1.0.1
1
ghcr.io/erlkoenig91/prompt-db-backend:1.0.7ab120359810d
starlette@0.41.3
1.0.1
1
ghcr.io/eslupmi/impulse:v3.7.03ded1b7ebca0
starlette@0.49.3
1.0.1
1
ghcr.io/esphome/esphome:latest000c5ee5ee96
starlette@0.52.1
1.0.1
1
ghcr.io/esphome/esphome:2026.4.078a82d810709
starlette@0.52.1
1.0.1
1
ghcr.io/gamosoft/notediscovery:0.31.5c06aa0fa9a85
starlette@0.27.0
1.0.1
1
ghcr.io/hemslo/chat-search:latest39d48995a5bd
starlette@0.37.2
1.0.1
1
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
starlette@0.46.0
1.0.1
1
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
starlette@0.50.0
1.0.1
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
starlette@0.52.1
1.0.1
1
ghcr.io/htunn/ansible-inspec:0.2.12cd25a5cc3f1b
starlette@0.52.1
1.0.1
1
ghcr.io/iisas/domino-rest:latest3009350bfc11
starlette@0.47.3
1.0.1
1
ghcr.io/immich-app/immich-machine-learning:v2.3.1379e31b8c751
starlette@0.41.2
1.0.1
1
ghcr.io/immich-app/immich-machine-learning:v3.1.05a0839dc5303
starlette@0.50.0
1.0.1
1
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
starlette@1.0.0
1.0.1
1
ghcr.io/jaydee94/kubeseal-webgui/api:4.5.33cceb9462ae1
starlette@0.36.3
1.0.1
1
ghcr.io/kubiyabot/sdk-py:v1.20.0f108f49570cc
starlette@0.39.2
1.0.1
1
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
starlette@0.41.0
1.0.1
1
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
starlette@0.37.2
1.0.1
1
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
starlette@0.49.1
1.0.1
1
ghcr.io/nicolargo/klances:0.1.374d6d33376eb
starlette@0.52.1
1.0.1
1
ghcr.io/openrelik/openrelik-mediator:latest42efc445b19e
starlette@0.46.2
1.0.1
1
ghcr.io/openrelik/openrelik-metrics:latest3d0f1ddeebf5
starlette@0.46.2
1.0.1
1
ghcr.io/openrelik/openrelik-server:latestce1132261523
starlette@0.46.2
1.0.1
1
ghcr.io/openrelik/openrelik-worker-analyzer-config:latest1269d3d8d2c2
starlette@0.46.2
1.0.1
1
ghcr.io/openrelik/openrelik-worker-analyzer-logs:latestb175cc61959a
starlette@0.46.2
1.0.1
1
ghcr.io/openrelik/openrelik-worker-bulkextractor:latest67498ee2e639
starlette@0.46.2
1.0.1
1
ghcr.io/openrelik/openrelik-worker-chromecreds:latest76d4fbcc6ff0
starlette@0.46.2
1.0.1
1
ghcr.io/openrelik/openrelik-worker-containers:latesta6d5abe94706
starlette@0.46.2
1.0.1
1
ghcr.io/openrelik/openrelik-worker-extraction:latestec9fc5864cd5
starlette@0.46.2
1.0.1
1
ghcr.io/openrelik/openrelik-worker-grep:latest470ff3529746
starlette@0.46.2
1.0.1
1
ghcr.io/openrelik/openrelik-worker-os-creds:latest7fc7ec101f08
starlette@0.46.2
1.0.1
1
ghcr.io/openrelik/openrelik-worker-plaso:latest75537ea8c851
starlette@0.46.2
1.0.1
1
ghcr.io/openrelik/openrelik-worker-strings:latest6e05055b701f
starlette@0.46.2
1.0.1
1
ghcr.io/openrelik/openrelik-worker-timesketch:latest4cb88b603cdc
starlette@0.46.2
1.0.1
1
ghcr.io/openrelik/openrelik-worker-yara:latestbd7fbf4505b5
starlette@0.46.2
1.0.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.