gjallarhorn

Exploited-vulnerability clocks for status-page, under EU Cyber Resilience Act Article 14

All clocks

CVE-2026-48710

#37 [DRILL] Exploited: CVE-2026-48710 in starlette 1.0.0 (releases 1.0.0) Closed

DRILL: NOT FILED. This clock replays a real catalogue entry against a test bed.

Component
starlette 1.0.0
Affected releases
1.0.0
Aware
Match report
the watch:match job

Deadlines

  1. Early Warning (EW) 24h

    Not filed

    Drafted in note 4004574608

    Due

    Status: Drafted

  2. 72h

    Not filed

    Drafted in note 4004591905

    Due

    Status: Drafted

  3. Final Report (FR)

    Not filed

    Drafted in note 4005086170

    Due

    Status: Drafted

Timeline

  1. Detected

    Secure

    Done

    aware_at from the match report

    the watch:match job

  2. Scoped

    Plan

    Not yet

    no scope note yet

  3. Mitigation opened

    Configure

    Done

    !11 Mitigate CVE-2026-48710: set TRUSTED_HOSTS on the hosted edition

    !11 to main

  4. Fix opened

    Create

    Done

    !12 Fix CVE-2026-48710 on 1.0: starlette 1.0.0 to 1.0.1, release 1.0.1

    !12 to release/1.0

  5. Approved

    Verify, Govern

    Done

    2 of 2 merged, by Brian

    !11 to main · !12 to release/1.0

  6. Released

    Package, Release

    Done

    1.0.1

    v1.0.1

  7. Probe passed

    Monitor

    Not yet

    awaiting the main line's fix and its deploy

  8. Final report drafted

    Govern

    Done

    the final-report pack

    the final-report draft

  9. Filed

    Govern

    Not yet

    DRILL: NOT FILED

The packs

Each field as ENISA's form names it, in the glossary's order, with the value to copy and where it came from.

Early warning Early Warning (EW) 24h

DRILL: NOT FILED

Status: Drafted. Drafted in note 4004574608.

FieldValueSource
1 Notification type (Vulnerability/Incident) Required Vulnerability gjallarhorn: an actively exploited vulnerability is notified as one
2 Title Required [DRILL] status-page 1.0.0: actively exploited CVE-2026-48710 in starlette 1.0.0 https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/jobs/17139361610
3 Summary Required DRILL, not for filing. Release 1.0.0 of status-page ships starlette 1.0.0. CVE-2026-48710 (https://www.cve.org/CVERecord?id=CVE-2026-48710), advisory GHSA-86qp-5c8j-p5mr (https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr). Marked actively exploited by CISA KEV and EUVD. Fixed in starlette 1.0.1. https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/jobs/17139361610
4 Manufacturer name Required Brian Isaac Kam manufacturer.yml
5 Member States where product available (Concerned CSIRT) Required Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden manufacturer.yml
6 Product Name Required status-page manufacturer.yml
7 Product Version Required 1.0.0 https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/jobs/17139361610
8 Product Type (Default/Important Product with Digital Elements/Critical Product with Digital Elements) Default manufacturer.yml
9 Product class Not given
10 Product category Self-hostable status page (web application, container image per release) manufacturer.yml
11 End of support indicator No supported-releases.yml
12 Component name starlette 1.0.0 https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/jobs/17139361610 (pkg:pypi/starlette@1.0.0)
13 Mitigating measure expected shortly Yes https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr (fixed in starlette 1.0.1)
14 User Action able to reduce impact Set TRUSTED_HOSTS to the host names status-page is served on (product/README.md), and upgrade to a release whose SBOM names starlette 1.0.1 or later once one is published. product/README.md; https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr
15 Considered sensitivity of information Not given
16 Corrective or mitigating measures taken Not given
17 Corrective or mitigating measures that users can take Not given
v19 CVE ID CVE-2026-48710 https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/jobs/17139361610
v20 EUVD ID EUVD-2026-32016 https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/jobs/17139361610
v21 General information Not given
v22 Date when corrective or mitigating measure has been available Not given
v23 Details about the security update/corrective measure available Not given
v24 Full description of the Severity of the vulnerability Not given
v25 Full description of the Impact of the vulnerability Not given
v26 Date and time when you become aware of the Actively Exploited Vulnerability Required 2026-10-13T12:21:59Z https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/jobs/17139361610 (aware_at)
v26a Date and time when the Actively Exploited Vulnerability occurred (UTC time) Not given
v27 Malicious actor that has exploited/is exploiting the vulnerability Unknown https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-48710): knownRansomwareCampaignUse Unknown
v30 Please provide further information Not given

Vulnerability notification 72h

DRILL: NOT FILED

Status: Drafted. Drafted in note 4004591905.

FieldValueSource
1 Notification type (Vulnerability/Incident) Required Vulnerability gjallarhorn: an actively exploited vulnerability is notified as one
2 Title Required [DRILL] status-page 1.0.0: actively exploited CVE-2026-48710 in starlette 1.0.0 https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/jobs/17139361610
3 Summary Required DRILL, not for filing. Release 1.0.0 of status-page ships starlette 1.0.0. CVE-2026-48710 (https://www.cve.org/CVERecord?id=CVE-2026-48710), advisory GHSA-86qp-5c8j-p5mr (https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr). Marked actively exploited by CISA KEV and EUVD. Fixed in starlette 1.0.1. https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/jobs/17139361610
4 Manufacturer name Required Brian Isaac Kam manufacturer.yml
5 Member States where product available (Concerned CSIRT) Required Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden manufacturer.yml
6 Product Name Required status-page manufacturer.yml
7 Product Version Required 1.0.0 https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/jobs/17139361610
8 Product Type (Default/Important Product with Digital Elements/Critical Product with Digital Elements) Default manufacturer.yml
9 Product class Not given
10 Product category Self-hostable status page (web application, container image per release) manufacturer.yml
11 End of support indicator No supported-releases.yml
12 Component name starlette 1.0.0 https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/jobs/17139361610 (pkg:pypi/starlette@1.0.0)
13 Mitigating measure expected shortly Yes https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr (fixed in starlette 1.0.1)
14 User Action able to reduce impact Set TRUSTED_HOSTS to the host names status-page is served on (product/README.md), and upgrade to a release whose SBOM names starlette 1.0.1 or later once one is published. product/README.md; https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr
15 Considered sensitivity of information No restricted handling is asked for: the advisory (GHSA-86qp-5c8j-p5mr, CVE-2026-48710) and its listing as actively exploited are public, and both are referred to here by id and URL only. gjallarhorn: a default for the responsible person to confirm
16 Corrective or mitigating measures taken A mitigation is being prepared: https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/merge_requests/11 sets TRUSTED_HOSTS on the hosted edition. A fix is being prepared: https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/merge_requests/12. Opened for review by the responsible person, not merged yet. No fixed release is published yet. https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/merge_requests/11; https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/merge_requests/12
17 Corrective or mitigating measures that users can take Set TRUSTED_HOSTS to the host names the service is served on (product/README.md), and upgrade once a release with starlette 1.0.1 or later is published. product/README.md; https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr
18 Attack vector As the advisory classifies it: see https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr and https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-32016. https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr; https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-32016
v19 CVE ID CVE-2026-48710 https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/jobs/17139361610
v20 EUVD ID EUVD-2026-32016 https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/jobs/17139361610
v21 General information Required status-page release 1.0.0 ships starlette 1.0.0, named in GHSA-86qp-5c8j-p5mr (https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr) and CVE-2026-48710 (https://www.cve.org/CVERecord?id=CVE-2026-48710), which CISA KEV and EUVD list as actively exploited. The fixed version is starlette 1.0.1. The advisory describes the weakness; this notification refers to it by id and URL. https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr; https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/jobs/17139361610
v22 Date when corrective or mitigating measure has been available Not given
v23 Details about the security update/corrective measure available Not given
v24 Full description of the Severity of the vulnerability Not given
v25 Full description of the Impact of the vulnerability Not given
v26 Date and time when you become aware of the Actively Exploited Vulnerability Required 2026-10-13T12:21:59Z https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/jobs/17139361610 (aware_at)
v26a Date and time when the Actively Exploited Vulnerability occurred (UTC time) Required 2026-09-02T00:00:00Z https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/jobs/17139361610 (EUVD exploitedSince, an estimate)
v27 Malicious actor that has exploited/is exploiting the vulnerability Unknown https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-48710): knownRansomwareCampaignUse Unknown
v28 Particular Exceptional Circumstances (PEC) Not given
v29 PEC Delay Reason Not given
v30 Please provide further information Not given

Final report Final Report (FR)

DRILL: NOT FILED

Status: Drafted. Drafted in note 4005086170.

FieldValueSource
1 Notification type (Vulnerability/Incident) Required Vulnerability gjallarhorn: an actively exploited vulnerability is notified as one
2 Title Required [DRILL] status-page 1.0.0: actively exploited CVE-2026-48710 in starlette 1.0.0 https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/jobs/17139361610
3 Summary Required DRILL, not for filing. Release 1.0.0 of status-page ships starlette 1.0.0. CVE-2026-48710 (https://www.cve.org/CVERecord?id=CVE-2026-48710), advisory GHSA-86qp-5c8j-p5mr (https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr). Marked actively exploited by CISA KEV and EUVD. Fixed in starlette 1.0.1. https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/jobs/17139361610
4 Manufacturer name Required Brian Isaac Kam manufacturer.yml
5 Member States where product available (Concerned CSIRT) Required Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden manufacturer.yml
6 Product Name Required status-page manufacturer.yml
7 Product Version Required 1.0.0 https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/jobs/17139361610
8 Product Type (Default/Important Product with Digital Elements/Critical Product with Digital Elements) Default manufacturer.yml
9 Product class Not given
10 Product category Self-hostable status page (web application, container image per release) manufacturer.yml
11 End of support indicator No supported-releases.yml
12 Component name starlette 1.0.0 https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/jobs/17139361610 (pkg:pypi/starlette@1.0.0)
13 Mitigating measure expected shortly No https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/releases/v1.0.1 (the measure is available)
14 User Action able to reduce impact Set TRUSTED_HOSTS to the host names status-page is served on (product/README.md), and upgrade to a release whose SBOM names starlette 1.0.1 or later once one is published. product/README.md; https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr
15 Considered sensitivity of information No restricted handling is asked for: the advisory (GHSA-86qp-5c8j-p5mr, CVE-2026-48710) and its listing as actively exploited are public, and both are referred to here by id and URL only. gjallarhorn: a default for the responsible person to confirm
16 Corrective or mitigating measures taken Required 2026-10-13 12:54 UTC: TRUSTED_HOSTS set on the hosted edition by https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/merge_requests/11, applied by tofu:apply (https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/jobs/17140046420). 2026-10-13 13:11 UTC: status-page 1.0.1 released, shipping starlette 1.0.1 in place of 1.0.0 on the 1.0 line. https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/releases/v1.0.1
17 Corrective or mitigating measures that users can take Required Upgrade to status-page 1.0.1 or later on the 1.0 line (https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/releases/v1.0.1). Until then, set TRUSTED_HOSTS to the host names the service is served on (product/README.md). https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/releases/v1.0.1; product/README.md
18 Attack vector As the advisory classifies it: see https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr and https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-32016. https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr; https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-32016
v19 CVE ID CVE-2026-48710 https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/jobs/17139361610
v20 EUVD ID EUVD-2026-32016 https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/jobs/17139361610
v21 General information Required status-page release 1.0.0 shipped starlette 1.0.0, named in GHSA-86qp-5c8j-p5mr (https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr) and CVE-2026-48710 (https://www.cve.org/CVERecord?id=CVE-2026-48710), which CISA KEV and EUVD list as actively exploited. The advisory describes the weakness; this report refers to it by id and URL. https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr; https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/jobs/17139361610
v22 Date when corrective or mitigating measure has been available Required 2026-10-13T12:54:06Z https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/jobs/17140046420 (D-P3, the earlier of: mitigation 2026-10-13T12:54:06Z, release 2026-10-13T13:11:46Z)
v23 Details about the security update/corrective measure available Required status-page 1.0.1 replaces starlette 1.0.0 with 1.0.1, the version GHSA-86qp-5c8j-p5mr names as fixed. The release carries the advisory note, its SBOM and corrective-measure.json, stamped at 2026-10-13T13:11:46Z by its release job (https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/jobs/17140650682). https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/releases/v1.0.1
v24 Full description of the Severity of the vulnerability Required Actively exploited: listed by CISA KEV (added 2026-09-02) and by EUVD (EUVD-2026-32016). The severity rating is the one given at https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr and https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-32016. https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr; https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-32016
v25 Full description of the Impact of the vulnerability Required status-page release 1.0.0 shipped the affected starlette 1.0.0; 1.0.1 ships 1.0.1. The hosted edition runs release 1.1.0, which is not among the affected releases. The impact of the weakness is as the advisory states it (https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr). https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/jobs/17139361610; supported-releases.yml; https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr
v26 Date and time when you become aware of the Actively Exploited Vulnerability Required 2026-10-13T12:21:59Z https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/jobs/17139361610 (aware_at)
v26a Date and time when the Actively Exploited Vulnerability occurred (UTC time) Required 2026-09-02T00:00:00Z https://gitlab.com/gitlab-ai-hackathon/transcend-october-2026/43267509/gjallarhorn/-/jobs/17139361610 (EUVD exploitedSince, an estimate)
v27 Malicious actor that has exploited/is exploiting the vulnerability Unknown https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-48710): knownRansomwareCampaignUse Unknown
v30 Please provide further information Not given