[DRILL] status-page 1.0.0: actively exploited CVE-2026-48710 in starlette 1.0.0
- Vulnerability
- CVE-2026-48710
- Affected versions
- 1.0.0
- Fixed versions
- 1.0.1
- Component
- starlette 1.0.0
- Machine-readable
- OSV JSON (schema 1.9.1)
What users can do
Set TRUSTED_HOSTS to the host names status-page is served on (product/README.md), and upgrade to a release whose SBOM names starlette 1.0.1 or later once one is published.
Upgrade to status-page 1.0.1 or later on the 1.0 line (https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/releases/v1.0.1). Until then, set TRUSTED_HOSTS to the host names the service is served on (product/README.md).
Details
status-page release 1.0.0 shipped starlette 1.0.0, named in GHSA-86qp-5c8j-p5mr (https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr) and CVE-2026-48710 (https://www.cve.org/CVERecord?id=CVE-2026-48710), which CISA KEV and EUVD list as actively exploited. The advisory describes the weakness; this report refers to it by id and URL.
Actively exploited: listed by CISA KEV (added 2026-09-02) and by EUVD (EUVD-2026-32016). The severity rating is the one given at https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr and https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-32016.
status-page release 1.0.0 shipped the affected starlette 1.0.0; 1.0.1 ships 1.0.1. The hosted edition runs release 1.1.0, which is not among the affected releases. The impact of the weakness is as the advisory states it (https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr).
References
Published ; last changed .