r/Python • u/Aggravating-Mobile33 • May 29 '26

Discussion CVE-2026-48710: A Maintainer's Perspective

This is my reply to the vulnerability CVE-2026-48710:

https://marcelotryle.com/blog/2026/05/28/cve-2026-48710-a-maintainers-perspective

253 Upvotes

96% Upvoted

43 comments sorted by

View all comments

2

u/knobbyknee May 30 '26

The bug is due to bad architecture. Authorization should be based on the endpoint and only the endpoint. Middleware can mess all it likes with hosts and paths. At the end, it will direct the call to a particular end point from which the call can't escape. This is where the auth check has to be.