StackRadar

CVE-2026-48710

MediumKEV

Advisory

Published 22 May 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.363
98th percentile
CISA KEV
Listed
since 2 Sept 2026
Charts affected
141
of 17,781 indexed, latest versions
Container images
172
deployed by those charts
Fix available
1 of 1
affected package

Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

Carried by container images the latest versions of 141 of 17,781 indexed charts deploy, on 172 images.

Affected packageAffected versionsFixed inImages
starlettepypi0.13.6, 0.13.8, 0.14.1, 0.14.2+30 more1.0.1172
OSV records
GHSA-86qp-5c8j-p5mr
Also known as
PYSEC-2026-161, X41-2026-002

Charts affected

141 by stars
ChartLatestAffected imagesRadar Score
dummy-servicephanVerified publisher0.3.41 of 1See more

dummy-service phan 0.3.4

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
phan2410/dummy-service:0.0.89c6ed6de26ca
starlette@0.40.0
1.0.1

Open the chart page →

5,706
phronetisphronetis0.1.271 of 2See more

phronetis phronetis 0.1.27

1 of the 2 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
knspar/phronetis:0.1.4609499d2dc91a
starlette@0.46.2
1.0.1

Open the chart page →

16,196
prompt-dbprompt-dbVerified publisher1.0.71 of 3See more

prompt-db prompt-db 1.0.7

1 of the 3 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/erlkoenig91/prompt-db-backend:1.0.7ab120359810d
starlette@0.41.3
1.0.1

Open the chart page →

3,332
python-fastapi-postgrespython-fastapi-postgres0.1.01 of 1See more

python-fastapi-postgres python-fastapi-postgres 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
archish27/python-fastapi-postgres:latest6610071a2101
starlette@0.19.1
1.0.1

Open the chart page →

2,983
helm-redchefredchef0.1.01 of 3See more

helm-redchef redchef 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
sharanalwar/redchef-backend:latest8d3cab80df49
starlette@0.27.0
1.0.1

Open the chart page →

4,763
request-registryrequest-registry0.1.01 of 2See more

request-registry request-registry 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
registry.gitlab.com/open-forms/request-registry:latest0886cbbc5f95
starlette@0.14.2
1.0.1

Open the chart page →

2,201
esphomeretsamedocVerified publisher2026.2.51 of 1See more

esphome retsamedoc 2026.2.5

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
esphome/esphome:2024.3.09ab8cc88b28c
starlette@0.35.1
1.0.1

Open the chart page →

7,431
rhbk-neurofacerhbk-neurofaceVerified publisher1.0.01 of 4See more

rhbk-neuroface rhbk-neuroface 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/neuroface-backend:latestcba71dc08c8a
starlette@0.41.3
1.0.1

Open the chart page →

3,781
ai-agentromholdings0.0.11 of 1See more

ai-agent romholdings 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
starlette@0.40.0
1.0.1

Open the chart page →

9,607
imgtagrotationalVerified publisher0.2.01 of 1See more

imgtag rotational 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
gcr.io/rotationalio-habanero/imgtag:89ec287a534a3170d03
starlette@0.37.2
1.0.1

Open the chart page →

3,312
agentdatarss30.1.01 of 1See more

agentdata rss3 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
starlette@0.36.3
1.0.1

Open the chart page →

3,512
noderss30.7.21 of 3See more

node rss3 0.7.2

1 of the 3 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
starlette@0.36.3
1.0.1

Open the chart page →

4,718
checkmkrtomik-helm-chartsVerified publisher0.1.01 of 1See more

checkmk rtomik-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
checkmk/check-mk-community:2.5.0p6c11b422210c4
starlette@0.50.0
1.0.1

Open the chart page →

7,436
runwhen-localrunwhen-contribVerified publisher0.6.171 of 3See more

runwhen-local runwhen-contrib 0.6.17

1 of the 3 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/runwhen-contrib/runwhen-local:0.12.0533ce58c6e02
starlette@0.46.2
1.0.1

Open the chart page →

3,707
test-helm-app1saam-helm-test0.1.01 of 1See more

test-helm-app1 saam-helm-test 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
hamidyousefi93/saam-test:latestc34f071f6ed0
starlette@0.27.0
1.0.1

Open the chart page →

3,887
test-helm-app2saam-helm-test0.1.01 of 1See more

test-helm-app2 saam-helm-test 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
asdkant/fastapi-hello-world:latesta23d8bf7c885
starlette@0.14.2
1.0.1

Open the chart page →

2,770
showroom-docs-mcpshowroom-docs-mcpVerified publisher2.1.01 of 4See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
litellm/litellm-non_root:v1.82.3-stable09b217802ded
starlette@0.49.1
1.0.1

Open the chart page →

5,201
mealiesmarthallVerified publisher0.0.101 of 1See more

mealie smarthall 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
starlette@0.37.2
1.0.1

Open the chart page →

5,565
srebotsrebot0.14.01 of 2See more

srebot srebot 0.14.0

1 of the 2 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/shadrus/srebot:0.14.09b4415e937b2
starlette@0.52.1
1.0.1

Open the chart page →

1,542
horcruxstakewise1.0.11 of 1See more

horcrux stakewise 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
stakewiselabs/bls-horcrux:v1.0.02afd0c0b34cb
starlette@0.13.6
1.0.1

Open the chart page →

1,421
verbasubstratusVerified publisher0.4.01 of 1See more

verba substratus 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
substratusai/verba:v0.4.0-baseURL261695be635eb
starlette@0.27.0
1.0.1

Open the chart page →

13,390
surogate-hubsurogate-hubVerified publisher2.1.51 of 1See more

surogate-hub surogate-hub 2.1.5

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
starlette@1.0.0
1.0.1

Open the chart page →

3,460
take-the-helmtake-the-helm0.1.01 of 1See more

take-the-helm take-the-helm 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
cadmusthefounder/lnd:take-the-helm-0.1.0e596c5fbf80f
starlette@0.19.1
1.0.1

Open the chart page →

805
tarkatarkaOfficialVerified publisher0.4.11 of 4See more

tarka tarka 0.4.1

1 of the 4 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
ghcr.io/tarkyaio/tarka:0.4.1e8d3f1512f06
starlette@0.52.1
1.0.1

Open the chart page →

1,556
asrtest-opea1.0.01 of 1See more

asr test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/asr:1.025dd26d9cd09
starlette@0.38.5
1.0.1

Open the chart page →

4,393
chatqnatest-opea1.0.05 of 11See more

chatqna test-opea 1.0.0

5 of the 11 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/chatqna:1.038c51b791efa
starlette@0.38.5
1.0.1
opea/embedding-tei:1.05c9639de61c1
starlette@0.38.5
1.0.1
opea/llm-tgi:1.00c25aab3f106
starlette@0.38.5
1.0.1
opea/reranking-tei:1.0e48613afb191
starlette@0.38.5
1.0.1
opea/retriever-redis:1.0eb746b263705
starlette@0.38.5
1.0.1

Open the chart page →

39,090
codegentest-opea1.0.02 of 5See more

codegen test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/codegen:1.058f91683892d
starlette@0.38.5
1.0.1
opea/llm-tgi:1.00c25aab3f106
starlette@0.38.5
1.0.1

Open the chart page →

28,814
codetranstest-opea1.0.02 of 5See more

codetrans test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/codetrans:1.0e2436483b73d
starlette@0.38.5
1.0.1
opea/llm-tgi:1.00c25aab3f106
starlette@0.38.5
1.0.1

Open the chart page →

28,385
docsumtest-opea1.0.02 of 5See more

docsum test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/docsum:1.03eaa91849512
starlette@0.38.5
1.0.1
opea/llm-docsum-tgi:1.002f9e8fa5d71
starlette@0.38.5
1.0.1

Open the chart page →

28,858
embedding-usvctest-opea1.0.01 of 1See more

embedding-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/embedding-tei:1.05c9639de61c1
starlette@0.38.5
1.0.1

Open the chart page →

5,185
guardrails-usvctest-opea1.0.01 of 1See more

guardrails-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/guardrails-tgi:1.0262c6048aab8
starlette@0.38.5
1.0.1

Open the chart page →

5,221
llm-uservicetest-opea1.0.01 of 1See more

llm-uservice test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/llm-tgi:1.00c25aab3f106
starlette@0.38.5
1.0.1

Open the chart page →

4,720
reranking-usvctest-opea1.0.01 of 1See more

reranking-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/reranking-tei:1.0e48613afb191
starlette@0.38.5
1.0.1

Open the chart page →

4,985
retriever-usvctest-opea1.0.01 of 1See more

retriever-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/retriever-redis:1.0eb746b263705
starlette@0.38.5
1.0.1

Open the chart page →

5,198
speecht5test-opea1.0.01 of 1See more

speecht5 test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/speecht5:1.0249afad3d268
starlette@0.38.5
1.0.1

Open the chart page →

9,616
ttstest-opea1.0.01 of 1See more

tts test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/tts:1.0257ae94709e9
starlette@0.38.5
1.0.1

Open the chart page →

4,377
web-retrievertest-opea1.0.01 of 1See more

web-retriever test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
opea/web-retriever-chroma:1.0fe08165d7770
starlette@0.38.5
1.0.1

Open the chart page →

5,350
kasa-exporterth-chartsVerified publisher0.1.01 of 1See more

kasa-exporter th-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
thelande/kasa_exporter:v0.2.3a1fdb8baa152
starlette@0.37.2
1.0.1

Open the chart page →

1,515
tfy-grafanatruefoundryVerified publisher0.1.211 of 3See more

tfy-grafana truefoundry 0.1.21

1 of the 3 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.1.2716b0b33ff2d
starlette@0.49.3
1.0.1

Open the chart page →

1,062
truefoundry-monitoringtruefoundryVerified publisher0.1.61 of 8See more

truefoundry-monitoring truefoundry 0.1.6

1 of the 8 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.1.2716b0b33ff2d
starlette@0.49.3
1.0.1

Open the chart page →

4,526
wazuhwazuh-helm-eksVerified publisher1.2.101 of 6See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2026-48710.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.14.45a065930682d
starlette@0.49.1
1.0.1

Open the chart page →

5,484

Container images carrying it

172 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
opea/llm-tgi:1.00c25aab3f106
starlette@0.38.5
1.0.1
4
quay.io/devtron/ai-agent:0.0.16545dac92173
starlette@0.40.0
1.0.1
3
opea/embedding-tei:1.05c9639de61c1
starlette@0.38.5
1.0.1
2
opea/reranking-tei:1.0e48613afb191
starlette@0.38.5
1.0.1
2
opea/retriever-redis:1.0eb746b263705
starlette@0.38.5
1.0.1
2
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
starlette@0.36.3
1.0.1
2
quay.io/kiwigrid/k8s-sidecar:2.1.2716b0b33ff2d
starlette@0.49.3
1.0.1
2
aibrix/metadata-service:v0.7.063fb81a64377
starlette@0.38.6
1.0.1
1
airbyte/manifest-server:7.23.73b3a670af168
starlette@0.47.3
1.0.1
1
aktosecurity/akto-agent-guard-anonymizer:1.1.4d4b100cbdc47
starlette@0.38.6
1.0.1
1
aktosecurity/akto-agent-guard-embedder:1.1.4dbc566b2376c
starlette@0.38.6
1.0.1
1
allegroai/clearml-serving-inference:1.3.0fca885e8cfc6
starlette@0.26.1
1.0.1
1
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
starlette@0.46.2
1.0.1
1
archish27/python-fastapi-postgres:latest6610071a2101
starlette@0.19.1
1.0.1
1
asdkant/fastapi-hello-world:latesta23d8bf7c885
starlette@0.14.2
1.0.1
1
assistiot/fl_repository:latest0fce3ea719a5
starlette@0.19.1
1.0.1
1
assistiot/fl_training_collector:latest792715dd3084
starlette@0.16.0
1.0.1
1
assistiot/open_api_backend:1.1.230812ba93555
starlette@0.27.0
1.0.1
1
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
starlette@0.50.0
1.0.1
1
bmeares/meerschaum:2.8.48e9c5bacaa82
starlette@0.45.3
1.0.1
1
cadmusthefounder/lnd:take-the-helm-0.1.0e596c5fbf80f
starlette@0.19.1
1.0.1
1
cdignam/kodiak:v0.54.05a6a55b39cee
starlette@0.20.4
1.0.1
1
chaostoolkit/back:latest734f3af86125
starlette@0.13.8
1.0.1
1
chaostoolkit/front:latest7f4a7eb9f7df
starlette@0.14.1
1.0.1
1
chaostoolkit/middle:latestb95ba4961cfc
starlette@0.14.1
1.0.1
1
checkmk/check-mk-community:2.5.0p6c11b422210c4
starlette@0.50.0
1.0.1
1
clowder/clowder2-backend:2.0.0-beta.411f3d844e4c0
starlette@0.26.1
1.0.1
1
clowder/clowder2-heartbeat:2.0.0-beta.414155326c7b9
starlette@0.26.1
1.0.1
1
clowder/clowder2-messages:2.0.0-beta.4bf146f1ca24f
starlette@0.26.1
1.0.1
1
clsen2024/gwangju_2-3:service-b-10ba9eff852c5
starlette@0.37.2
1.0.1
1
clsen2024/gwangju_2-3:service-a-151b1d45961cd
starlette@0.37.2
1.0.1
1
clsen2024/gwangju_2-3:service-c-1efb1586c8299
starlette@0.37.2
1.0.1
1
codecov/self-hosted-api:24.4.10475cb1c3136
starlette@0.36.2
1.0.1
1
douz/helpdesk:latest4384103d0219
starlette@0.19.1
1.0.1
1
dserio83/velero-api:0.3.16b3d9115fee2
starlette@0.45.3
1.0.1
1
dserio83/velero-watchdog:0.1.8d5deae589229
starlette@0.45.3
1.0.1
1
eclipseaerios/aerios-k8s-shim:v1.0.0d4ed3d8e5db4
starlette@0.38.4
1.0.1
1
eclipseaerios/hlo-data-aggregator:v3.0.0b433c2b9f5dc
starlette@0.36.3
1.0.1
1
eclipseaerios/hlo-deployment-engine:v3.0.0d582d39208c7
starlette@0.35.1
1.0.1
1
eclipseaerios/hlo-fe-engine:v3.0.08ed2df4ca692
starlette@0.36.3
1.0.1
1
eclipseaerios/trust-manager:1.0.0f55442e2c0ed
starlette@0.49.3
1.0.1
1
esphome/esphome:1.18.03f51ec10e823
starlette@0.14.2
1.0.1
1
esphome/esphome:2026.7.44866347cb5b4
starlette@0.52.1
1.0.1
1
esphome/esphome:2026.8.285abea33854b
starlette@0.52.1
1.0.1
1
esphome/esphome:2024.3.09ab8cc88b28c
starlette@0.35.1
1.0.1
1
esphome/esphome:2024.12.2b2c6322700ac
starlette@0.39.2
1.0.1
1
esphome/esphome:2025.3.0def8b6e4f517
starlette@0.39.2
1.0.1
1
evk02/mlflow:2.2.1ef6ff257ef35
starlette@0.22.0
1.0.1
1
factly/hunting:0.2.0-stagv1.2ca5bc71d1d5c
starlette@0.20.4
1.0.1
1
hamidyousefi93/saam-test:latestc34f071f6ed0
starlette@0.27.0
1.0.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.