Repository navigation
Bump starlette in v1 to fix CVE-2026-48710 #6038
Description
🔴 Required Information
Currently, ADK v1 requires starlette prior to version 1, which contains the vulnerability reported in CVE-2026-48710. It was already fixed in v2 (#5894) but not in v1.
Describe the Bug:
ADK v1 depends on an outdated version of starlette that needs to be bumped to address CVE-2026-48710.
Activity
surajksharma07 commentedon Jun 10, 2026
/adk-issue-analyze
surajksharma07 commentedon Jun 10, 2026
@lucasoshiro Thanks for catching this — you're right that the fix in #5894 only landed on main, leaving v1 users still exposed.
As a quick mitigation, try adding starlette>=1.0.1 to your project's requirements and confirm that clears the vulnerability on your end.
We'll work on getting the same bump applied to the v1 branch — appreciate the detailed CVE context!
lucasoshiro commentedon Jun 10, 2026
Thanks @surajksharma07 !
mikerepede commentedon Jun 17, 2026
Things have gotten even worse in the past couple days. There are 2 more high severity CVEs:
@surajksharma07 What is the outlook for getting this fix applied to ADK v1? Thanks!
lucasoshiro commentedon Jul 11, 2026
Hi @surajksharma07 and @mikerepede !
I opened this PR changing the version of
starlette: #6378surajksharma07 commentedon Jul 13, 2026
@lucasoshiro Thanks for opening #6378 — checked the diff and it only bumps starlette to 1.0.1, which closes the original CVE-2026-48710 but not the two @mikerepede flagged: CVE-2026-48818 needs >=1.1.0 and CVE-2026-54283 needs >=1.3.1, so v1 would still be exposed to both of those right after this merges.
Could you bump the lower bound to >=1.3.1 instead so all three close together?
Separately — main/v2's pyproject.toml is still pinned at starlette>=1.0.1,<2 too, so this same gap needs a follow-up bump there as well, independent of this issue!
Team is looking more into it.
Thanks!
fix: require starlette>=1.3.1 to clear known CVEs
dcsullivanMT commentedon Jul 17, 2026
I would like to request that this issue be reopened. Although the PR was merged, the necessary Starlette version bump has not yet been reflected in a v1 release. As this issue specifically concerns ensuring the v1 branch is protected, it should remain open until the fix is released for v1.
itworsley commentedon Jul 21, 2026
Would like to second @dcsullivanMT's request here. This is becoming a blocker/severe risk for those not yet ready to update ADK to v2
starlettein v1 to fix multiple CVEs (including HIGH-classified CVEs) #6567 as a duplicate of this issuefix: require starlette>=1.3.1 to clear known CVEs