StackRadar

CVE-2026-48710

MediumKEV

Advisory

Published 22 May 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.363
98th percentile
CISA KEV
Listed
since 2 Sept 2026
Charts affected
141
of 17,781 indexed, latest versions
Container images
172
deployed by those charts
Fix available
1 of 1
affected package

Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

Carried by container images the latest versions of 141 of 17,781 indexed charts deploy, on 172 images.

Affected packageAffected versionsFixed inImages
starlettepypi0.13.6, 0.13.8, 0.14.1, 0.14.2+30 more1.0.1172
OSV records
GHSA-86qp-5c8j-p5mr
Also known as
PYSEC-2026-161, X41-2026-002

Charts affected

141 by stars
ChartLatestAffected imagesRadar Score
codecovdoubanVerified publisher0.2.41 of 8See more

codecov douban 0.2.4

1 of the 8 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
codecov/self-hosted-api:24.4.10475cb1c3136
starlette@0.36.2
1.0.1

Open the chart page →

24,917
helpdeskdoubanVerified publisher0.3.31 of 2See more

helpdesk douban 0.3.3

1 of the 2 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
douz/helpdesk:latest4384103d0219
starlette@0.19.1
1.0.1

Open the chart page →

4,550
aerios-k8s-shimeclipse-aeriosVerified publisher1.0.01 of 1See more

aerios-k8s-shim eclipse-aerios 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
eclipseaerios/aerios-k8s-shim:v1.0.0d4ed3d8e5db4
starlette@0.38.4
1.0.1

Open the chart page →

1,434
hlo-data-aggregatoreclipse-aeriosVerified publisher3.0.01 of 1See more

hlo-data-aggregator eclipse-aerios 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
eclipseaerios/hlo-data-aggregator:v3.0.0b433c2b9f5dc
starlette@0.36.3
1.0.1

Open the chart page →

1,643
hlo-deployment-engineeclipse-aeriosVerified publisher3.0.01 of 1See more

hlo-deployment-engine eclipse-aerios 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
eclipseaerios/hlo-deployment-engine:v3.0.0d582d39208c7
starlette@0.35.1
1.0.1

Open the chart page →

1,653
hlo-fe-engineeclipse-aeriosVerified publisher3.0.01 of 1See more

hlo-fe-engine eclipse-aerios 3.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
eclipseaerios/hlo-fe-engine:v3.0.08ed2df4ca692
starlette@0.36.3
1.0.1

Open the chart page →

1,643
trustmanagereclipse-aeriosVerified publisher1.0.01 of 1See more

trustmanager eclipse-aerios 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
eclipseaerios/trust-manager:1.0.0f55442e2c0ed
starlette@0.49.3
1.0.1

Open the chart page →

1,895
esphomeegebackVerified publisher2.0.251 of 1See more

esphome egeback 2.0.25

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
esphome/esphome:2026.7.44866347cb5b4
starlette@0.52.1
1.0.1

Open the chart page →

3,121
rommernail-romm1.0.11 of 1See more

romm ernail-romm 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
rommapp/romm:4.4.1b909e95d1aab
starlette@0.49.1
1.0.1

Open the chart page →

2,896
huntingfactlyVerified publisher0.4.141 of 1See more

hunting factly 0.4.14

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
factly/hunting:0.2.0-stagv1.2ca5bc71d1d5c
starlette@0.20.4
1.0.1

Open the chart page →

4,085
kodiakfikaworks1.1.41 of 2See more

kodiak fikaworks 1.1.4

1 of the 2 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
cdignam/kodiak:v0.54.05a6a55b39cee
starlette@0.20.4
1.0.1

Open the chart page →

3,892
forms-catalogueforms-catalogue0.1.01 of 2See more

forms-catalogue forms-catalogue 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
registry.gitlab.com/open-forms/forms-catalogue:latest4eaf9c911f33
starlette@0.14.2
1.0.1

Open the chart page →

2,188
esphomegabe565Verified publisher0.15.01 of 1See more

esphome gabe565 0.15.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:latest000c5ee5ee96
starlette@0.52.1
1.0.1

Open the chart page →

3,112
skypilotgeek-cookbookVerified publisher0.0.11 of 3See more

skypilot geek-cookbook 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
starlette@0.50.0
1.0.1

Open the chart page →

8,923
gwangju_2-3gwangju2-30.1.03 of 5See more

gwangju_2-3 gwangju2-3 0.1.0

3 of the 5 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
clsen2024/gwangju_2-3:service-b-10ba9eff852c5
starlette@0.37.2
1.0.1
clsen2024/gwangju_2-3:service-a-151b1d45961cd
starlette@0.37.2
1.0.1
clsen2024/gwangju_2-3:service-c-1efb1586c8299
starlette@0.37.2
1.0.1

Open the chart page →

6,491
rag-apihajowielandVerified publisher1.0.01 of 1See more

rag-api hajowieland 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/danny-avila/librechat-rag-api-dev-lite:latestf9f34c8ed688
starlette@0.46.2
1.0.1

Open the chart page →

1,683
esphomehelm-chart-roeiVerified publisher2025.3.01 of 1See more

esphome helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
esphome/esphome:2025.3.0def8b6e4f517
starlette@0.39.2
1.0.1

Open the chart page →

6,008
home-assistanthelm-chart-roeiVerified publisher2025.3.01 of 1See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
starlette@0.46.0
1.0.1

Open the chart page →

4,647
fastmcp-serverhelmforgeVerified publisher1.7.41 of 1See more

fastmcp-server helmforge 1.7.4

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
helmforge/fastmcp-server:0.11.2fcb7017327d6
starlette@1.0.0
1.0.1

Open the chart page →

3,281
immichhelmforgeVerified publisher1.2.81 of 5See more

immich helmforge 1.2.8

1 of the 5 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-machine-learning:v3.1.05a0839dc5303
starlette@0.50.0
1.0.1

Open the chart page →

11,042
mcp-serverhelmforgeVerified publisher1.0.01 of 1See more

mcp-server helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
helmforge/fastmcp-server:0.2.061f759a1421f
starlette@1.0.0
1.0.1

Open the chart page →

3,430
notediscoveryhelmforgeVerified publisher2.0.11 of 1See more

notediscovery helmforge 2.0.1

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/gamosoft/notediscovery:0.31.5c06aa0fa9a85
starlette@0.27.0
1.0.1

Open the chart page →

1,241
impulseimpulse1.0.161 of 1See more

impulse impulse 1.0.16

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/eslupmi/impulse:v3.7.03ded1b7ebca0
starlette@0.49.3
1.0.1

Open the chart page →

1,348
guardrails-usvcinfracloud-chartsVerified publisher1.0.11 of 1See more

guardrails-usvc infracloud-charts 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/guardrails-tgi:latestf68bec6a1271
starlette@0.41.3
1.0.1

Open the chart page →

5,062
intelowlintelowl-helm6.6.1-01-06-20261 of 5See more

intelowl intelowl-helm 6.6.1-01-06-2026

1 of the 5 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
intelowlproject/intelowl:v6.6.10b22e547ea6b
starlette@0.48.0
1.0.1

Open the chart page →

17,852
esphomejeffrescVerified publisher0.2.21 of 1See more

esphome jeffresc 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/esphome/esphome:2026.4.078a82d810709
starlette@0.52.1
1.0.1

Open the chart page →

5,040
graphiti-mcpkiberonlabs0.1.21 of 1See more

graphiti-mcp kiberonlabs 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
zepai/knowledge-graph-mcp:v0.2.16ab0ee79926b
starlette@0.47.1
1.0.1

Open the chart page →

3,393
lnbitskronkltdVerified publisher0.1.01 of 1See more

lnbits kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
lnbitsdocker/lnbits-legend:latest26fae6327477
starlette@0.27.0
1.0.1

Open the chart page →

1,444
mindsdbkronkltdVerified publisher0.1.01 of 1See more

mindsdb kronkltd 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
mindsdb/mindsdb:latest163011c09299
starlette@1.0.0
1.0.1

Open the chart page →

9,620
pavkrzwiatrzyk0.0.31 of 1See more

pav krzwiatrzyk 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
witcherek7/pav:0.0.342a744f29ac0
starlette@0.22.0
1.0.1

Open the chart page →

1,132
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
starlette@0.46.2
1.0.1

Open the chart page →

8,405
kubiya-runnerkubiya-helm-chartsOfficialVerified publisher0.9.41 of 9See more

kubiya-runner kubiya-helm-charts 0.9.4

1 of the 9 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/kubiyabot/sdk-py:v1.20.0f108f49570cc
starlette@0.39.2
1.0.1

Open the chart page →

20,204
lightlyticslightlytics0.1.211 of 2See more

lightlytics lightlytics 0.1.21

1 of the 2 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
public.ecr.aws/k6v9y5g3/cluster-agent:cost_k8s_process.5769e14a72b066d
starlette@0.41.3
1.0.1

Open the chart page →

5,354
lnbitslnbits0.2.11 of 1See more

lnbits lnbits 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
lnbitsdocker/lnbits-legend:0.10.6a11aaa6d2b21
starlette@0.19.1
1.0.1

Open the chart page →

1,949
exposureloglsst-sqre0.2.11 of 1See more

exposurelog lsst-sqre 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
lsstsqre/exposurelog:0.8.079b00fb67a65
starlette@0.17.1
1.0.1

Open the chart page →

2,078
nodecg-chartmarathon-charts0.1.51 of 2See more

nodecg-chart marathon-charts 0.1.5

1 of the 2 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/rodg/rtmp-controller:latest67f99a5beab7
starlette@0.17.1
1.0.1

Open the chart page →

7,315
meerschaummeerschaumVerified publisher0.2.01 of 1See more

meerschaum meerschaum 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
bmeares/meerschaum:2.8.48e9c5bacaa82
starlette@0.45.3
1.0.1

Open the chart page →

5,823
memgraph-mcpmemgraphVerified publisher1.0.01 of 1See more

memgraph-mcp memgraph 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
memgraph/mcp-memgraph:0.1.13ecdf7faea3f7
starlette@1.0.0
1.0.1

Open the chart page →

1,672
MINTmint8.0.21 of 15See more

MINT mint 8.0.2

1 of the 15 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
mintproject/model-catalog-fastapi:7dd88dc5bf1fe6a6d4703ea0a077afee45cb256102260d20a21f
starlette@0.20.4
1.0.1

Open the chart page →

43,341
sample-appmongodb-helm-charts0.1.01 of 2See more

sample-app mongodb-helm-charts 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
quay.io/mongodb/farm-intro-backend:0.11a9ce0b8fbd4
starlette@0.13.6
1.0.1

Open the chart page →

6,438
face-recognitionmoreillonVerified publisher0.2.41 of 3See more

face-recognition moreillon 0.2.4

1 of the 3 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
moreillon/face-recognition-fastapi:x86bacb2ddd8394
starlette@0.19.1
1.0.1

Open the chart page →

8,556
my-fastapi-chartmy-fastapi-template0.1.01 of 1See more

my-fastapi-chart my-fastapi-template 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
john19968010/fastapi-template:latest31a90f6bd69c
starlette@0.26.1
1.0.1

Open the chart page →

967
mlflowncsaVerified publisher1.2.11 of 4See more

mlflow ncsa 1.2.1

1 of the 4 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
evk02/mlflow:2.2.1ef6ff257ef35
starlette@0.22.0
1.0.1

Open the chart page →

5,456
neurofaceneurofaceVerified publisher1.4.21 of 3See more

neuroface neuroface 1.4.2

1 of the 3 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/neuroface-backend:v1.4.13194d46df0f9
starlette@0.41.3
1.0.1

Open the chart page →

7,310
octantisoctantis0.1.01 of 1See more

octantis octantis 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/vinny1892/octantis:latest45459c0910fc
starlette@1.0.0
1.0.1

Open the chart page →

2,555
mockoidcoidcmockVerified publisher0.0.11 of 1See more

mockoidc oidcmock 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
marcoimme/oidcmock:latestb6035c0721a8
starlette@0.35.1
1.0.1

Open the chart page →

2,298
chatbot-ai-sampleopenshift0.1.61 of 4See more

chatbot-ai-sample openshift 0.1.6

1 of the 4 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
quay.io/ai-lab/llamacpp_python:latest70d138997acd
starlette@0.46.2
1.0.1

Open the chart page →

18,922
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.016 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

16 of the 40 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
yetiplatform/yeti:2.9.09bcbe2650a14
starlette@0.46.2
1.0.1
ghcr.io/openrelik/openrelik-mediator:latest42efc445b19e
starlette@0.46.2
1.0.1
ghcr.io/openrelik/openrelik-metrics:latest3d0f1ddeebf5
starlette@0.46.2
1.0.1
ghcr.io/openrelik/openrelik-server:latestce1132261523
starlette@0.46.2
1.0.1
ghcr.io/openrelik/openrelik-worker-analyzer-config:latest1269d3d8d2c2
starlette@0.46.2
1.0.1
ghcr.io/openrelik/openrelik-worker-analyzer-logs:latestb175cc61959a
starlette@0.46.2
1.0.1
ghcr.io/openrelik/openrelik-worker-bulkextractor:latest67498ee2e639
starlette@0.46.2
1.0.1
ghcr.io/openrelik/openrelik-worker-chromecreds:latest76d4fbcc6ff0
starlette@0.46.2
1.0.1
ghcr.io/openrelik/openrelik-worker-containers:latesta6d5abe94706
starlette@0.46.2
1.0.1
ghcr.io/openrelik/openrelik-worker-extraction:latestec9fc5864cd5
starlette@0.46.2
1.0.1
ghcr.io/openrelik/openrelik-worker-grep:latest470ff3529746
starlette@0.46.2
1.0.1
ghcr.io/openrelik/openrelik-worker-os-creds:latest7fc7ec101f08
starlette@0.46.2
1.0.1
ghcr.io/openrelik/openrelik-worker-plaso:latest75537ea8c851
starlette@0.46.2
1.0.1
ghcr.io/openrelik/openrelik-worker-strings:latest6e05055b701f
starlette@0.46.2
1.0.1
ghcr.io/openrelik/openrelik-worker-timesketch:latest4cb88b603cdc
starlette@0.46.2
1.0.1
ghcr.io/openrelik/openrelik-worker-yara:latestbd7fbf4505b5
starlette@0.46.2
1.0.1

Open the chart page →

71,208
yetiosdfir-infrastructureVerified publisher1.0.51 of 4See more

yeti osdfir-infrastructure 1.0.5

1 of the 4 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
yetiplatform/yeti:latest9c3006cedcca
starlette@0.46.2
1.0.1

Open the chart page →

6,583
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
starlette@0.50.0
1.0.1

Open the chart page →

4,749

Container images carrying it

172 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/rodg/rtmp-controller:latest67f99a5beab7
starlette@0.17.1
1.0.1
1
ghcr.io/runwhen-contrib/runwhen-local:0.12.0533ce58c6e02
starlette@0.46.2
1.0.1
1
ghcr.io/shadrus/srebot:0.14.09b4415e937b2
starlette@0.52.1
1.0.1
1
ghcr.io/tarkyaio/tarka:0.4.1e8d3f1512f06
starlette@0.52.1
1.0.1
1
ghcr.io/tauffer-consulting/domino-rest:latest8bf880fe8c73
starlette@0.27.0
1.0.1
1
ghcr.io/vinny1892/octantis:latest45459c0910fc
starlette@1.0.0
1.0.1
1
ghcr.io/wgbh-mla/pbcore-util:pr-66e04659a3baa
starlette@0.49.3
1.0.1
1
public.ecr.aws/k6v9y5g3/cluster-agent:cost_k8s_process.5769e14a72b066d
starlette@0.41.3
1.0.1
1
quay.io/ai-lab/llamacpp_python:latest70d138997acd
starlette@0.46.2
1.0.1
1
quay.io/maximilianopizarro/neuroface-backend:v1.4.13194d46df0f9
starlette@0.41.3
1.0.1
1
quay.io/maximilianopizarro/neuroface-backend:latestcba71dc08c8a
starlette@0.41.3
1.0.1
1
quay.io/mongodb/farm-intro-backend:0.11a9ce0b8fbd4
starlette@0.13.6
1.0.1
1
quay.io/ortelius/ms-compitem-crud:main-v10.0.1566-gf3f81597b7f49eec76
starlette@0.50.0
1.0.1
1
quay.io/ortelius/ms-dep-pkg-cud:main-v10.0.1670-g9abe110c0c881b509a
starlette@0.50.0
1.0.1
1
quay.io/ortelius/ms-dep-pkg-r:main-v10.0.1705-g21b3dc8a4150e94a45
starlette@0.50.0
1.0.1
1
quay.io/ortelius/ms-sbom-export:main-v10.0.933-g2e222ef43bdaa51598
starlette@0.50.0
1.0.1
1
quay.io/ortelius/ms-scorecard:main-v10.0.1276-g966a8a43337e52fdd4
starlette@0.50.0
1.0.1
1
quay.io/ortelius/ms-textfile-crud:main-v10.0.1635-g5076aaf5c4c8adfc82
starlette@0.50.0
1.0.1
1
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
starlette@0.50.0
1.0.1
1
registry.gitlab.com/open-forms/design-catalogue:latestf21f19346b29
starlette@0.14.2
1.0.1
1
registry.gitlab.com/open-forms/forms-catalogue:latest4eaf9c911f33
starlette@0.14.2
1.0.1
1
registry.gitlab.com/open-forms/request-registry:latest0886cbbc5f95
starlette@0.14.2
1.0.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.