{ "document": { "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en-US", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Stackable GmbH and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "product-security@stackable.tech", "issuing_authority": "The Stackable Security Team is responsible for vulnerability handling across all Stackable offerings.", "name": "Stackable GmbH", "namespace": "https://www.stackable.tech/" }, "title": "Stackable Security Advisory for: CVE-2026-48710", "tracking": { "current_release_date": "2026-07-13T09:49:02.720276Z", "generator": { "engine": { "name": "SecObserve", "version": "1.54.0" } }, "id": "CVE-2026-48710", "initial_release_date": "2026-07-13T09:49:02.720276Z", "revision_history": [ { "date": "2026-07-13T09:49:02.720276Z", "number": "1", "summary": "Initial release" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "3.0.6-stackable26.3.0-amd64", "product": { "name": "airflow:3.0.6-stackable26.3.0-amd64", "product_id": "pkg:oci/airflow@sha256%3A413100ba2cb4db0d44057b3caf3bc8326ee40d9b3dd949ec289e5dc5f85ca7d9?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow", "product_identification_helper": { "purl": "pkg:oci/airflow@sha256:413100ba2cb4db0d44057b3caf3bc8326ee40d9b3dd949ec289e5dc5f85ca7d9?arch=amd64&repository_url=oci.stackable.tech/sdp/airflow" } } }, { "category": "product_version", "name": "3.1.6-stackable26.3.0-amd64", "product": { "name": "airflow:3.1.6-stackable26.3.0-amd64", "product_id": "pkg:oci/airflow@sha256%3A97d12e5a214c94ed8606cff7a859c79a8922120244e8dc899c8581a343615ff5?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow", "product_identification_helper": { "purl": "pkg:oci/airflow@sha256:97d12e5a214c94ed8606cff7a859c79a8922120244e8dc899c8581a343615ff5?arch=amd64&repository_url=oci.stackable.tech/sdp/airflow" } } }, { "category": "product_version", "name": "3.0.1-stackable25.11.0-amd64", "product": { "name": "airflow:3.0.1-stackable25.11.0-amd64", "product_id": "pkg:oci/airflow@sha256%3Abac4a703fceeec87fee04e92da8feb8d7fd922f151186ee8c6b14c9444190f2d?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow", "product_identification_helper": { "purl": "pkg:oci/airflow@sha256:bac4a703fceeec87fee04e92da8feb8d7fd922f151186ee8c6b14c9444190f2d?arch=amd64&repository_url=oci.stackable.tech/sdp/airflow" } } }, { "category": "product_version", "name": "3.0.6-stackable25.11.0-amd64", "product": { "name": "airflow:3.0.6-stackable25.11.0-amd64", "product_id": "pkg:oci/airflow@sha256%3A6d4b45a99cc85a574611af243edcf31e367ac4e3e437d49f02987fe1a80b0e36?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow", "product_identification_helper": { "purl": "pkg:oci/airflow@sha256:6d4b45a99cc85a574611af243edcf31e367ac4e3e437d49f02987fe1a80b0e36?arch=amd64&repository_url=oci.stackable.tech/sdp/airflow" } } } ], "category": "product_name", "name": "airflow" } ], "category": "architecture", "name": "amd64" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "3.0.6-stackable26.3.0-arm64", "product": { "name": "airflow:3.0.6-stackable26.3.0-arm64", "product_id": "pkg:oci/airflow@sha256%3Ab76c7375a627636e13db6ac41147805172db85464e366e6fafd8c20e6a7e3046?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow", "product_identification_helper": { "purl": "pkg:oci/airflow@sha256:b76c7375a627636e13db6ac41147805172db85464e366e6fafd8c20e6a7e3046?arch=arm64&repository_url=oci.stackable.tech/sdp/airflow" } } }, { "category": "product_version", "name": "3.1.6-stackable26.3.0-arm64", "product": { "name": "airflow:3.1.6-stackable26.3.0-arm64", "product_id": "pkg:oci/airflow@sha256%3Ae7949e338f28d85e51c70b1319a11ae545516dcf0eb75ca757fd69bf16e4590e?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow", "product_identification_helper": { "purl": "pkg:oci/airflow@sha256:e7949e338f28d85e51c70b1319a11ae545516dcf0eb75ca757fd69bf16e4590e?arch=arm64&repository_url=oci.stackable.tech/sdp/airflow" } } }, { "category": "product_version", "name": "3.0.1-stackable25.11.0-arm64", "product": { "name": "airflow:3.0.1-stackable25.11.0-arm64", "product_id": "pkg:oci/airflow@sha256%3Ae1228b2b5b67ef0aaa6331764acc9d786e65475ea5429a459758d6590104367b?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow", "product_identification_helper": { "purl": "pkg:oci/airflow@sha256:e1228b2b5b67ef0aaa6331764acc9d786e65475ea5429a459758d6590104367b?arch=arm64&repository_url=oci.stackable.tech/sdp/airflow" } } }, { "category": "product_version", "name": "3.0.6-stackable25.11.0-arm64", "product": { "name": "airflow:3.0.6-stackable25.11.0-arm64", "product_id": "pkg:oci/airflow@sha256%3Ac232050f870ec81f1af449e0db34e5b1b515fea9c23adfb9f71156b130bffcb3?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow", "product_identification_helper": { "purl": "pkg:oci/airflow@sha256:c232050f870ec81f1af449e0db34e5b1b515fea9c23adfb9f71156b130bffcb3?arch=arm64&repository_url=oci.stackable.tech/sdp/airflow" } } } ], "category": "product_name", "name": "airflow" } ], "category": "architecture", "name": "arm64" } ], "category": "vendor", "name": "Stackable" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "0.47.2", "product": { "name": "starlette:0.47.2", "product_id": "pkg:pypi/starlette@0.47.2", "product_identification_helper": { "purl": "pkg:pypi/starlette@0.47.2" } } }, { "category": "product_version", "name": "0.48.0", "product": { "name": "starlette:0.48.0", "product_id": "pkg:pypi/starlette@0.48.0", "product_identification_helper": { "purl": "pkg:pypi/starlette@0.48.0" } } }, { "category": "product_version", "name": "0.46.2", "product": { "name": "starlette:0.46.2", "product_id": "pkg:pypi/starlette@0.46.2", "product_identification_helper": { "purl": "pkg:pypi/starlette@0.46.2" } } } ], "category": "product_name", "name": "starlette" } ], "category": "vendor", "name": "unknown" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "pkg:pypi/starlette@0.47.2@pkg:oci/airflow@sha256%3A413100ba2cb4db0d44057b3caf3bc8326ee40d9b3dd949ec289e5dc5f85ca7d9?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow", "product_id": "pkg:pypi/starlette@0.47.2@pkg:oci/airflow@sha256%3A413100ba2cb4db0d44057b3caf3bc8326ee40d9b3dd949ec289e5dc5f85ca7d9?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow" }, "product_reference": "pkg:pypi/starlette@0.47.2", "relates_to_product_reference": "pkg:oci/airflow@sha256%3A413100ba2cb4db0d44057b3caf3bc8326ee40d9b3dd949ec289e5dc5f85ca7d9?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:pypi/starlette@0.48.0@pkg:oci/airflow@sha256%3A97d12e5a214c94ed8606cff7a859c79a8922120244e8dc899c8581a343615ff5?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow", "product_id": "pkg:pypi/starlette@0.48.0@pkg:oci/airflow@sha256%3A97d12e5a214c94ed8606cff7a859c79a8922120244e8dc899c8581a343615ff5?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow" }, "product_reference": "pkg:pypi/starlette@0.48.0", "relates_to_product_reference": "pkg:oci/airflow@sha256%3A97d12e5a214c94ed8606cff7a859c79a8922120244e8dc899c8581a343615ff5?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:pypi/starlette@0.47.2@pkg:oci/airflow@sha256%3Ab76c7375a627636e13db6ac41147805172db85464e366e6fafd8c20e6a7e3046?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow", "product_id": "pkg:pypi/starlette@0.47.2@pkg:oci/airflow@sha256%3Ab76c7375a627636e13db6ac41147805172db85464e366e6fafd8c20e6a7e3046?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow" }, "product_reference": "pkg:pypi/starlette@0.47.2", "relates_to_product_reference": "pkg:oci/airflow@sha256%3Ab76c7375a627636e13db6ac41147805172db85464e366e6fafd8c20e6a7e3046?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:pypi/starlette@0.48.0@pkg:oci/airflow@sha256%3Ae7949e338f28d85e51c70b1319a11ae545516dcf0eb75ca757fd69bf16e4590e?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow", "product_id": "pkg:pypi/starlette@0.48.0@pkg:oci/airflow@sha256%3Ae7949e338f28d85e51c70b1319a11ae545516dcf0eb75ca757fd69bf16e4590e?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow" }, "product_reference": "pkg:pypi/starlette@0.48.0", "relates_to_product_reference": "pkg:oci/airflow@sha256%3Ae7949e338f28d85e51c70b1319a11ae545516dcf0eb75ca757fd69bf16e4590e?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:pypi/starlette@0.46.2@pkg:oci/airflow@sha256%3Abac4a703fceeec87fee04e92da8feb8d7fd922f151186ee8c6b14c9444190f2d?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow", "product_id": "pkg:pypi/starlette@0.46.2@pkg:oci/airflow@sha256%3Abac4a703fceeec87fee04e92da8feb8d7fd922f151186ee8c6b14c9444190f2d?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow" }, "product_reference": "pkg:pypi/starlette@0.46.2", "relates_to_product_reference": "pkg:oci/airflow@sha256%3Abac4a703fceeec87fee04e92da8feb8d7fd922f151186ee8c6b14c9444190f2d?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:pypi/starlette@0.47.2@pkg:oci/airflow@sha256%3A6d4b45a99cc85a574611af243edcf31e367ac4e3e437d49f02987fe1a80b0e36?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow", "product_id": "pkg:pypi/starlette@0.47.2@pkg:oci/airflow@sha256%3A6d4b45a99cc85a574611af243edcf31e367ac4e3e437d49f02987fe1a80b0e36?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow" }, "product_reference": "pkg:pypi/starlette@0.47.2", "relates_to_product_reference": "pkg:oci/airflow@sha256%3A6d4b45a99cc85a574611af243edcf31e367ac4e3e437d49f02987fe1a80b0e36?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:pypi/starlette@0.46.2@pkg:oci/airflow@sha256%3Ae1228b2b5b67ef0aaa6331764acc9d786e65475ea5429a459758d6590104367b?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow", "product_id": "pkg:pypi/starlette@0.46.2@pkg:oci/airflow@sha256%3Ae1228b2b5b67ef0aaa6331764acc9d786e65475ea5429a459758d6590104367b?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow" }, "product_reference": "pkg:pypi/starlette@0.46.2", "relates_to_product_reference": "pkg:oci/airflow@sha256%3Ae1228b2b5b67ef0aaa6331764acc9d786e65475ea5429a459758d6590104367b?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow" }, { "category": "default_component_of", "full_product_name": { "name": "pkg:pypi/starlette@0.47.2@pkg:oci/airflow@sha256%3Ac232050f870ec81f1af449e0db34e5b1b515fea9c23adfb9f71156b130bffcb3?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow", "product_id": "pkg:pypi/starlette@0.47.2@pkg:oci/airflow@sha256%3Ac232050f870ec81f1af449e0db34e5b1b515fea9c23adfb9f71156b130bffcb3?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow" }, "product_reference": "pkg:pypi/starlette@0.47.2", "relates_to_product_reference": "pkg:oci/airflow@sha256%3Ac232050f870ec81f1af449e0db34e5b1b515fea9c23adfb9f71156b130bffcb3?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-48710", "flags": [ { "label": "vulnerable_code_not_in_execute_path", "product_ids": [ "pkg:pypi/starlette@0.47.2@pkg:oci/airflow@sha256%3A413100ba2cb4db0d44057b3caf3bc8326ee40d9b3dd949ec289e5dc5f85ca7d9?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow", "pkg:pypi/starlette@0.47.2@pkg:oci/airflow@sha256%3Ab76c7375a627636e13db6ac41147805172db85464e366e6fafd8c20e6a7e3046?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow", "pkg:pypi/starlette@0.46.2@pkg:oci/airflow@sha256%3Abac4a703fceeec87fee04e92da8feb8d7fd922f151186ee8c6b14c9444190f2d?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow", "pkg:pypi/starlette@0.47.2@pkg:oci/airflow@sha256%3A6d4b45a99cc85a574611af243edcf31e367ac4e3e437d49f02987fe1a80b0e36?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow", "pkg:pypi/starlette@0.46.2@pkg:oci/airflow@sha256%3Ae1228b2b5b67ef0aaa6331764acc9d786e65475ea5429a459758d6590104367b?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow", "pkg:pypi/starlette@0.47.2@pkg:oci/airflow@sha256%3Ac232050f870ec81f1af449e0db34e5b1b515fea9c23adfb9f71156b130bffcb3?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow" ] }, { "label": "vulnerable_code_cannot_be_controlled_by_adversary", "product_ids": [ "pkg:pypi/starlette@0.48.0@pkg:oci/airflow@sha256%3A97d12e5a214c94ed8606cff7a859c79a8922120244e8dc899c8581a343615ff5?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow", "pkg:pypi/starlette@0.48.0@pkg:oci/airflow@sha256%3Ae7949e338f28d85e51c70b1319a11ae545516dcf0eb75ca757fd69bf16e4590e?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow" ] } ], "notes": [ { "category": "description", "text": "Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope[\"server\"]` for malformed values.", "title": "Vulnerability description" } ], "product_status": { "known_not_affected": [ "pkg:pypi/starlette@0.47.2@pkg:oci/airflow@sha256%3A413100ba2cb4db0d44057b3caf3bc8326ee40d9b3dd949ec289e5dc5f85ca7d9?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow", "pkg:pypi/starlette@0.48.0@pkg:oci/airflow@sha256%3A97d12e5a214c94ed8606cff7a859c79a8922120244e8dc899c8581a343615ff5?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow", "pkg:pypi/starlette@0.47.2@pkg:oci/airflow@sha256%3Ab76c7375a627636e13db6ac41147805172db85464e366e6fafd8c20e6a7e3046?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow", "pkg:pypi/starlette@0.48.0@pkg:oci/airflow@sha256%3Ae7949e338f28d85e51c70b1319a11ae545516dcf0eb75ca757fd69bf16e4590e?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow", "pkg:pypi/starlette@0.46.2@pkg:oci/airflow@sha256%3Abac4a703fceeec87fee04e92da8feb8d7fd922f151186ee8c6b14c9444190f2d?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow", "pkg:pypi/starlette@0.47.2@pkg:oci/airflow@sha256%3A6d4b45a99cc85a574611af243edcf31e367ac4e3e437d49f02987fe1a80b0e36?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow", "pkg:pypi/starlette@0.46.2@pkg:oci/airflow@sha256%3Ae1228b2b5b67ef0aaa6331764acc9d786e65475ea5429a459758d6590104367b?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow", "pkg:pypi/starlette@0.47.2@pkg:oci/airflow@sha256%3Ac232050f870ec81f1af449e0db34e5b1b515fea9c23adfb9f71156b130bffcb3?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow" ] }, "references": [ { "category": "external", "summary": "Security Advisory", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48710" } ], "threats": [ { "category": "impact", "details": "BadHost desyncs request.url.path from the routed ASGI scope path via a malformed Host header. It is exploitable only when the application makes a security decision based on request.url rather than the raw scope path. Airflow's FastAPI/Starlette api-server does not. Authorization (requires_access_dag/pool/connection/variable/etc.) is gated on request.path_params and request.query_params, which come from scope-based routing rather than request.url. The only request.url reads in the api-server build a cosmetic backend_server_base_url for the login template, which is not a security check.\n\nThe task-log server in Airflow 3.0.6 is a Flask/WSGI app. It matches the requested file via request.view_args (routing-derived) rather than Starlette request.url, so it lies outside the vulnerable Starlette code path. No request.url-based security decision is reachable, so the Host-header desync cannot bypass any restriction.", "product_ids": [ "pkg:pypi/starlette@0.47.2@pkg:oci/airflow@sha256%3A413100ba2cb4db0d44057b3caf3bc8326ee40d9b3dd949ec289e5dc5f85ca7d9?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow", "pkg:pypi/starlette@0.47.2@pkg:oci/airflow@sha256%3Ab76c7375a627636e13db6ac41147805172db85464e366e6fafd8c20e6a7e3046?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow" ] }, { "category": "impact", "details": "BadHost is exploitable only when an application makes a security decision from request.url instead of the raw ASGI scope path, and an attacker can inject the Host header. The airflow api-server, the only exposed HTTP surface on :8080, gates authorization on scope-based request.path_params and query_params. Its only reads of request.url build a cosmetic login-template base_url, so it is not affected.\n\nThe one security-relevant request.url.path check is in JWTAuthStaticFiles, part of the worker/triggerer task-log server on :8793/:8794. It compares the JWT 'filename' claim against request.url.path while serving the file from scope['path']. That endpoint is not reachable by an adversary. The operator publishes only port 8080 plus the metrics port, so 8793/8794 is not exposed as a Service, and every request needs a JWT signed with the internal secret_key.\n\nThe only legitimate client of that endpoint is the api-server itself. It builds the fetch URL as http://{worker-hostname}:8793/log/... from the task instance's own hostname, in _fetch_logs_from_service via requests.get. The client's Host header is never forwarded, so the internal request carries a well-formed Host, and an adversary has no way to deliver a malformed one to the vulnerable check. Anyone who could reach :8793 with a crafted Host would already hold the signing secret, letting them mint a token for any log and read it directly, or already run arbitrary task code.", "product_ids": [ "pkg:pypi/starlette@0.48.0@pkg:oci/airflow@sha256%3A97d12e5a214c94ed8606cff7a859c79a8922120244e8dc899c8581a343615ff5?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow", "pkg:pypi/starlette@0.48.0@pkg:oci/airflow@sha256%3Ae7949e338f28d85e51c70b1319a11ae545516dcf0eb75ca757fd69bf16e4590e?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow" ] }, { "category": "impact", "details": "CVE-2026-48710 (BadHost) lets a malformed HTTP Host header desync request.url.path from the routed ASGI scope path. Security checks that authorize from request.url instead of the raw scope path can then be bypassed. This code path is not reached in the airflow image.\n\nThe only exposed HTTP surface is the api-server (:8080), whose authorization is scope-based. requires_access_* in api_fastapi/core_api/security.py decides from request.path_params and request.query_params, not request.url. request.url is used there only to build a cosmetic backend_server_base_url for the login template, which is not a security decision.\n\nIn airflow 3.0.x the worker/triggerer task-log server is a Flask/WSGI app that resolves the filename from routing (request.view_args). It never uses Starlette's request.url. The request.url.path-based check only appears from 3.1.x. No reachable component makes a security decision from request.url.", "product_ids": [ "pkg:pypi/starlette@0.46.2@pkg:oci/airflow@sha256%3Abac4a703fceeec87fee04e92da8feb8d7fd922f151186ee8c6b14c9444190f2d?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow", "pkg:pypi/starlette@0.47.2@pkg:oci/airflow@sha256%3A6d4b45a99cc85a574611af243edcf31e367ac4e3e437d49f02987fe1a80b0e36?arch=amd64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow", "pkg:pypi/starlette@0.46.2@pkg:oci/airflow@sha256%3Ae1228b2b5b67ef0aaa6331764acc9d786e65475ea5429a459758d6590104367b?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow", "pkg:pypi/starlette@0.47.2@pkg:oci/airflow@sha256%3Ac232050f870ec81f1af449e0db34e5b1b515fea9c23adfb9f71156b130bffcb3?arch=arm64&repository_url=oci.stackable.tech%2Fsdp%2Fairflow" ] } ], "title": "CVE-2026-48710" } ] }