StackRadar

CVE-2026-48710

MediumKEV

Advisory

Published 22 May 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.363
98th percentile
CISA KEV
Listed
since 2 Sept 2026
Charts affected
141
of 17,781 indexed, latest versions
Container images
172
deployed by those charts
Fix available
1 of 1
affected package

Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

Carried by container images the latest versions of 141 of 17,781 indexed charts deploy, on 172 images.

Affected packageAffected versionsFixed inImages
starlettepypi0.13.6, 0.13.8, 0.14.1, 0.14.2+30 more1.0.1172
OSV records
GHSA-86qp-5c8j-p5mr
Also known as
PYSEC-2026-161, X41-2026-002

Charts affected

141 by stars
ChartLatestAffected imagesRadar Score
dummy-servicephanVerified publisher0.3.41 of 1See more

dummy-service phan 0.3.4

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
phan2410/dummy-service:0.0.89c6ed6de26ca
starlette@0.40.0
1.0.1

Open the chart page →

5,706
phronetisphronetis0.1.271 of 2See more

phronetis phronetis 0.1.27

1 of the 2 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
knspar/phronetis:0.1.4609499d2dc91a
starlette@0.46.2
1.0.1

Open the chart page →

16,196
prompt-dbprompt-dbVerified publisher1.0.71 of 3See more

prompt-db prompt-db 1.0.7

1 of the 3 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/erlkoenig91/prompt-db-backend:1.0.7ab120359810d
starlette@0.41.3
1.0.1

Open the chart page →

3,332
python-fastapi-postgrespython-fastapi-postgres0.1.01 of 1See more

python-fastapi-postgres python-fastapi-postgres 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
archish27/python-fastapi-postgres:latest6610071a2101
starlette@0.19.1
1.0.1

Open the chart page →

2,983
helm-redchefredchef0.1.01 of 3See more

helm-redchef redchef 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
sharanalwar/redchef-backend:latest8d3cab80df49
starlette@0.27.0
1.0.1

Open the chart page →

4,763
request-registryrequest-registry0.1.01 of 2See more

request-registry request-registry 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
registry.gitlab.com/open-forms/request-registry:latest0886cbbc5f95
starlette@0.14.2
1.0.1

Open the chart page →

2,201
esphomeretsamedocVerified publisher2026.2.51 of 1See more

esphome retsamedoc 2026.2.5

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
esphome/esphome:2024.3.09ab8cc88b28c
starlette@0.35.1
1.0.1

Open the chart page →

7,431
rhbk-neurofacerhbk-neurofaceVerified publisher1.0.01 of 4See more

rhbk-neuroface rhbk-neuroface 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/neuroface-backend:latestcba71dc08c8a
starlette@0.41.3
1.0.1

Open the chart page →

3,781
ai-agentromholdings0.0.11 of 1See more

ai-agent romholdings 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
starlette@0.40.0
1.0.1

Open the chart page →

9,607
imgtagrotationalVerified publisher0.2.01 of 1See more

imgtag rotational 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
gcr.io/rotationalio-habanero/imgtag:89ec287a534a3170d03
starlette@0.37.2
1.0.1

Open the chart page →

3,312
agentdatarss30.1.01 of 1See more

agentdata rss3 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
starlette@0.36.3
1.0.1

Open the chart page →

3,512
noderss30.7.21 of 3See more

node rss3 0.7.2

1 of the 3 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
starlette@0.36.3
1.0.1

Open the chart page →

4,718
checkmkrtomik-helm-chartsVerified publisher0.1.01 of 1See more

checkmk rtomik-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
checkmk/check-mk-community:2.5.0p6c11b422210c4
starlette@0.50.0
1.0.1

Open the chart page →

7,436
runwhen-localrunwhen-contribVerified publisher0.6.171 of 3See more

runwhen-local runwhen-contrib 0.6.17

1 of the 3 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/runwhen-contrib/runwhen-local:0.12.0533ce58c6e02
starlette@0.46.2
1.0.1

Open the chart page →

3,707
test-helm-app1saam-helm-test0.1.01 of 1See more

test-helm-app1 saam-helm-test 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
hamidyousefi93/saam-test:latestc34f071f6ed0
starlette@0.27.0
1.0.1

Open the chart page →

3,887
test-helm-app2saam-helm-test0.1.01 of 1See more

test-helm-app2 saam-helm-test 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
asdkant/fastapi-hello-world:latesta23d8bf7c885
starlette@0.14.2
1.0.1

Open the chart page →

2,770
showroom-docs-mcpshowroom-docs-mcpVerified publisher2.1.01 of 4See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
litellm/litellm-non_root:v1.82.3-stable09b217802ded
starlette@0.49.1
1.0.1

Open the chart page →

5,201
mealiesmarthallVerified publisher0.0.101 of 1See more

mealie smarthall 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
starlette@0.37.2
1.0.1

Open the chart page →

5,565
srebotsrebot0.14.01 of 2See more

srebot srebot 0.14.0

1 of the 2 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/shadrus/srebot:0.14.09b4415e937b2
starlette@0.52.1
1.0.1

Open the chart page →

1,542
horcruxstakewise1.0.11 of 1See more

horcrux stakewise 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
stakewiselabs/bls-horcrux:v1.0.02afd0c0b34cb
starlette@0.13.6
1.0.1

Open the chart page →

1,421
verbasubstratusVerified publisher0.4.01 of 1See more

verba substratus 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
substratusai/verba:v0.4.0-baseURL261695be635eb
starlette@0.27.0
1.0.1

Open the chart page →

13,390
surogate-hubsurogate-hubVerified publisher2.1.51 of 1See more

surogate-hub surogate-hub 2.1.5

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
starlette@1.0.0
1.0.1

Open the chart page →

3,460
take-the-helmtake-the-helm0.1.01 of 1See more

take-the-helm take-the-helm 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
cadmusthefounder/lnd:take-the-helm-0.1.0e596c5fbf80f
starlette@0.19.1
1.0.1

Open the chart page →

805
tarkatarkaOfficialVerified publisher0.4.11 of 4See more

tarka tarka 0.4.1

1 of the 4 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/tarkyaio/tarka:0.4.1e8d3f1512f06
starlette@0.52.1
1.0.1

Open the chart page →

1,556
asrtest-opea1.0.01 of 1See more

asr test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/asr:1.025dd26d9cd09
starlette@0.38.5
1.0.1

Open the chart page →

4,393
chatqnatest-opea1.0.05 of 11See more

chatqna test-opea 1.0.0

5 of the 11 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/chatqna:1.038c51b791efa
starlette@0.38.5
1.0.1
opea/embedding-tei:1.05c9639de61c1
starlette@0.38.5
1.0.1
opea/llm-tgi:1.00c25aab3f106
starlette@0.38.5
1.0.1
opea/reranking-tei:1.0e48613afb191
starlette@0.38.5
1.0.1
opea/retriever-redis:1.0eb746b263705
starlette@0.38.5
1.0.1

Open the chart page →

39,090
codegentest-opea1.0.02 of 5See more

codegen test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/codegen:1.058f91683892d
starlette@0.38.5
1.0.1
opea/llm-tgi:1.00c25aab3f106
starlette@0.38.5
1.0.1

Open the chart page →

28,814
codetranstest-opea1.0.02 of 5See more

codetrans test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/codetrans:1.0e2436483b73d
starlette@0.38.5
1.0.1
opea/llm-tgi:1.00c25aab3f106
starlette@0.38.5
1.0.1

Open the chart page →

28,385
docsumtest-opea1.0.02 of 5See more

docsum test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/docsum:1.03eaa91849512
starlette@0.38.5
1.0.1
opea/llm-docsum-tgi:1.002f9e8fa5d71
starlette@0.38.5
1.0.1

Open the chart page →

28,858
embedding-usvctest-opea1.0.01 of 1See more

embedding-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/embedding-tei:1.05c9639de61c1
starlette@0.38.5
1.0.1

Open the chart page →

5,185
guardrails-usvctest-opea1.0.01 of 1See more

guardrails-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/guardrails-tgi:1.0262c6048aab8
starlette@0.38.5
1.0.1

Open the chart page →

5,221
llm-uservicetest-opea1.0.01 of 1See more

llm-uservice test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/llm-tgi:1.00c25aab3f106
starlette@0.38.5
1.0.1

Open the chart page →

4,720
reranking-usvctest-opea1.0.01 of 1See more

reranking-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/reranking-tei:1.0e48613afb191
starlette@0.38.5
1.0.1

Open the chart page →

4,985
retriever-usvctest-opea1.0.01 of 1See more

retriever-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/retriever-redis:1.0eb746b263705
starlette@0.38.5
1.0.1

Open the chart page →

5,198
speecht5test-opea1.0.01 of 1See more

speecht5 test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/speecht5:1.0249afad3d268
starlette@0.38.5
1.0.1

Open the chart page →

9,616
ttstest-opea1.0.01 of 1See more

tts test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/tts:1.0257ae94709e9
starlette@0.38.5
1.0.1

Open the chart page →

4,377
web-retrievertest-opea1.0.01 of 1See more

web-retriever test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/web-retriever-chroma:1.0fe08165d7770
starlette@0.38.5
1.0.1

Open the chart page →

5,350
kasa-exporterth-chartsVerified publisher0.1.01 of 1See more

kasa-exporter th-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
thelande/kasa_exporter:v0.2.3a1fdb8baa152
starlette@0.37.2
1.0.1

Open the chart page →

1,515
tfy-grafanatruefoundryVerified publisher0.1.211 of 3See more

tfy-grafana truefoundry 0.1.21

1 of the 3 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.1.2716b0b33ff2d
starlette@0.49.3
1.0.1

Open the chart page →

1,062
truefoundry-monitoringtruefoundryVerified publisher0.1.61 of 8See more

truefoundry-monitoring truefoundry 0.1.6

1 of the 8 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.1.2716b0b33ff2d
starlette@0.49.3
1.0.1

Open the chart page →

4,526
wazuhwazuh-helm-eksVerified publisher1.2.101 of 6See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.14.45a065930682d
starlette@0.49.1
1.0.1

Open the chart page →

5,484

Container images carrying it

172 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/rodg/rtmp-controller:latest67f99a5beab7
starlette@0.17.1
1.0.1
1
ghcr.io/runwhen-contrib/runwhen-local:0.12.0533ce58c6e02
starlette@0.46.2
1.0.1
1
ghcr.io/shadrus/srebot:0.14.09b4415e937b2
starlette@0.52.1
1.0.1
1
ghcr.io/tarkyaio/tarka:0.4.1e8d3f1512f06
starlette@0.52.1
1.0.1
1
ghcr.io/tauffer-consulting/domino-rest:latest8bf880fe8c73
starlette@0.27.0
1.0.1
1
ghcr.io/vinny1892/octantis:latest45459c0910fc
starlette@1.0.0
1.0.1
1
ghcr.io/wgbh-mla/pbcore-util:pr-66e04659a3baa
starlette@0.49.3
1.0.1
1
public.ecr.aws/k6v9y5g3/cluster-agent:cost_k8s_process.5769e14a72b066d
starlette@0.41.3
1.0.1
1
quay.io/ai-lab/llamacpp_python:latest70d138997acd
starlette@0.46.2
1.0.1
1
quay.io/maximilianopizarro/neuroface-backend:v1.4.13194d46df0f9
starlette@0.41.3
1.0.1
1
quay.io/maximilianopizarro/neuroface-backend:latestcba71dc08c8a
starlette@0.41.3
1.0.1
1
quay.io/mongodb/farm-intro-backend:0.11a9ce0b8fbd4
starlette@0.13.6
1.0.1
1
quay.io/ortelius/ms-compitem-crud:main-v10.0.1566-gf3f81597b7f49eec76
starlette@0.50.0
1.0.1
1
quay.io/ortelius/ms-dep-pkg-cud:main-v10.0.1670-g9abe110c0c881b509a
starlette@0.50.0
1.0.1
1
quay.io/ortelius/ms-dep-pkg-r:main-v10.0.1705-g21b3dc8a4150e94a45
starlette@0.50.0
1.0.1
1
quay.io/ortelius/ms-sbom-export:main-v10.0.933-g2e222ef43bdaa51598
starlette@0.50.0
1.0.1
1
quay.io/ortelius/ms-scorecard:main-v10.0.1276-g966a8a43337e52fdd4
starlette@0.50.0
1.0.1
1
quay.io/ortelius/ms-textfile-crud:main-v10.0.1635-g5076aaf5c4c8adfc82
starlette@0.50.0
1.0.1
1
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
starlette@0.50.0
1.0.1
1
registry.gitlab.com/open-forms/design-catalogue:latestf21f19346b29
starlette@0.14.2
1.0.1
1
registry.gitlab.com/open-forms/forms-catalogue:latest4eaf9c911f33
starlette@0.14.2
1.0.1
1
registry.gitlab.com/open-forms/request-registry:latest0886cbbc5f95
starlette@0.14.2
1.0.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.