Access Server: CVE-2026-48710 Starlette Vulnerability False Positive

Description

Some vulnerability and security scanners may flag OpenVPN Access Server as vulnerable to CVE-2026-48710 because it includes a version of the Starlette dependency earlier than 1.0.1.

OpenVPN's development team investigated this finding and confirmed that Access Server isn't affected by CVE-2026-48710 due to how Starlette is implemented in the product.

We plan to update the Starlette dependency in a future Access Server release.

Solution

No action is required. Access Server isn't affected by this vulnerability, and the scanner finding is a false positive.

Need help?

If you have questions, submit a support ticket.