{"id":2679,"date":"2026-09-09T15:00:00","date_gmt":"2026-09-09T15:00:00","guid":{"rendered":"https:\/\/netguide.io\/news\/?p=2679"},"modified":"2026-09-09T15:00:00","modified_gmt":"2026-09-09T15:00:00","slug":"starlette-luecke-cve-2026-48710-cisa-warnt-aktive-ausnutzung","status":"publish","type":"post","link":"https:\/\/netguide.io\/news\/de\/2026\/09\/09\/starlette-luecke-cve-2026-48710-cisa-warnt-aktive-ausnutzung\/","title":{"rendered":"Starlette-L\u00fccke CVE-2026-48710: CISA warnt vor aktiver Ausnutzung"},"content":{"rendered":"<div id=\"netgu-2417853432\" class=\"netgu-before-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"3494115342\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><p class=\"wp-block-paragraph\"><strong>Die US-Sicherheitsbeh\u00f6rde CISA hat die Schwachstelle CVE-2026-48710 im weit verbreiteten Python-Framework Starlette am 2. September 2026 in ihren Katalog bekannter ausgenutzter Sicherheitsl\u00fccken (KEV) aufgenommen. Angreifer nutzen den Fehler bereits aktiv, um Authentifizierungspr\u00fcfungen zu umgehen.<\/strong><\/p>\n\n<h3 class=\"wp-block-heading\">Manipulierter Host-Header vergiftet den Pfad<\/h3>\n\n<p class=\"wp-block-paragraph\">Kern des Problems ist eine fehlende Validierung des HTTP-Host-Headers. Starlette setzt die Eigenschaft <code>request.url<\/code> aus dem angreiferkontrollierten Host-Header und dem Anfragepfad zusammen und parst das Ergebnis erneut. Dadurch kann <code>request.url.path<\/code> von dem Pfad abweichen, den der ASGI-Server tats\u00e4chlich zum Routing verwendet. Pr\u00fcft eine Middleware die Zugriffsrechte anhand von <code>request.url.path<\/code>, bewertet sie einen gef\u00e4lschten Pfad, w\u00e4hrend im Hintergrund die eigentlich gesch\u00fctzte Route ausgef\u00fchrt wird.<\/p><div id=\"netgu-2802901763\" class=\"netgu-content netgu-entity-placement\"><aside class=\"deals-top deals-top--compact\">\n\n\t\t\t<h3 class=\"deals-top__title\">Top-Deals<\/h3>\n\t\n\t\t\t<ul class=\"deals-top__list\">\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/ml2u-226-watch-face-fuer-wearos-im-google-play-store\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/10\/deal-3-150x150.png\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">ML2U 226 Watch Face f\u00fcr WearOS im Google Play Store<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>1.39 \u20ac<\/s>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-100%<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t55\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/star-citizen-twitch-drops-deko-fuer-den-hangar\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/10\/source-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Star Citizen Twitch Drops \u2013 Deko f\u00fcr den Hangar<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t55\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/moon-knight-digital-watch-face-fuer-wear-os-4\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/deal-27-150x150.png\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">MOON KNIGHT Digital Watch Face f\u00fcr Wear OS 4+<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>0.89 \u20ac<\/s>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-100%<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t55\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/battlefield-6-code-fuer-spielerkartenhintergrund-und-titel\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/10\/battlefield-6-how-to-redeem-codes-asset-code-9-2026_de-150x150.webp\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Battlefield 6 \u2013 Code f\u00fcr Spielerkartenhintergrund und Titel<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t55\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/train-sim-world-7-starter-pack-kostenlos-fuer-ps4-ps5-xbox-pc\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/capsule_616x353-11-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Train Sim World 7: Starter Pack kostenlos f\u00fcr PS4, PS5, Xbox, PC<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">Gratis<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t55\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t<\/ul>\n\n\t\t\t\t\t<p class=\"deals-top__more\">\n\t\t\t\t<a href=\"https:\/\/netguide.io\/deals\/\">Alle Deals ansehen \u2192<\/a>\n\t\t\t<\/p>\n\t\t\t<\/aside>\n<\/div>\n\n<p class=\"wp-block-paragraph\">Das Ergebnis ist ein Authentifizierungs-Bypass f\u00fcr unauthentifizierte Angreifer aus dem Netz. Die Schwachstelle vom Typ CWE-444 (HTTP Request Smuggling) ist mit einem CVSS-Wert von 6.5 als mittelschwer eingestuft. Ihre Reichweite ist dennoch erheblich, da Starlette als Unterbau des popul\u00e4ren Web-Frameworks FastAPI in zahllosen Produktiv-APIs steckt.<\/p>\n\n<h3 class=\"wp-block-heading\">Update auf Version 1.0.1 einspielen<\/h3>\n\n<p class=\"wp-block-paragraph\">Die Entwickler haben den Fehler in Starlette 1.0.1 behoben. Diese Version validiert den Host-Header gegen die Vorgaben aus RFC 9112 und RFC 3986 und greift bei ung\u00fcltigen Werten auf <code>scope[\"server\"]<\/code> zur\u00fcck. Betreiber sollten zeitnah aktualisieren; laut Sicherheitsforschern l\u00e4sst sich die L\u00fccke mit CVE-2026-42271 zu einer Remote-Code-Ausf\u00fchrung gegen LiteLLM-Instanzen verketten. Die CISA verpflichtet US-Bundesbeh\u00f6rden, die L\u00fccke bis zum 16. September 2026 zu schlie\u00dfen.<\/p>\n\n<p class=\"wp-block-paragraph\"><em>Quellen: <a href=\"https:\/\/www.cisa.gov\/news-events\/alerts\/2026\/09\/02\/cisa-adds-seven-known-exploited-vulnerabilities-catalog\" target=\"_blank\" rel=\"noopener\">CISA KEV-Alert<\/a> &middot; <a href=\"https:\/\/advisories.gitlab.com\/pypi\/starlette\/CVE-2026-48710\/\" target=\"_blank\" rel=\"noopener\">GitLab Advisory Database<\/a> &middot; <a href=\"https:\/\/thehackernews.com\/2026\/09\/cisa-adds-seven-exploited-flaws-as.html\" target=\"_blank\" rel=\"noopener\">The Hacker News<\/a><\/em><\/p><div id=\"netgu-3325388830\" class=\"netgu-after-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"4559785002\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>Eine Host-Header-Schwachstelle im Python-Framework Starlette umgeht Pfad-basierte Zugriffskontrollen. Die CISA setzte den Bug am 2. September auf ihre Liste bekannter ausgenutzter L\u00fccken.<\/p>\n","protected":false},"author":1,"featured_media":1722,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_affilinode_tracking":"","_affilinode_autolink_off":false,"_affilinode_rating":"","site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[109,13],"tags":[],"class_list":["post-2679","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","category-news"],"brizy_media":[],"_links":{"self":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/2679","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/comments?post=2679"}],"version-history":[{"count":1,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/2679\/revisions"}],"predecessor-version":[{"id":2763,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/2679\/revisions\/2763"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/media\/1722"}],"wp:attachment":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/media?parent=2679"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/categories?post=2679"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/tags?post=2679"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}