Vulnerability record · CVE-2026-48710 · published 26 May 2026
CVE-2026-48710: Starlette Host header validation flaw enables request.url path mismatch
Encode · Starlette
Starlette before 1.0.1 did not validate the HTTP Host header before using it to rebuild request.url, so a malformed Host value could make request.url.path differ from the path actually requested. Middleware and endpoints that enforce security restrictions based on request.url instead of the raw scope path could therefore be bypassed. The flaw is tracked as CWE-444 HTTP request smuggling and CWE-1289.
Description
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Automated analysis
high priorityThe flaw allows authentication and authorization bypass with no privileges or user interaction, is listed in CISA KEV with a 2026-09-16 due date, and has a high EPSS percentile, though CVSS impact is limited to low confidentiality and integrity.
What it is
Starlette before 1.0.1 did not validate the HTTP Host header before using it to rebuild request.url, so a malformed Host value could make request.url.path differ from the path actually requested. Middleware and endpoints that enforce security restrictions based on request.url instead of the raw scope path could therefore be bypassed. The flaw is tracked as CWE-444 HTTP request smuggling and CWE-1289.
Impact
An attacker can bypass access controls implemented against request.url, potentially reaching restricted routes or resources. The CVSS 3.1 vector shows low confidentiality and low integrity impact with no availability impact.
Attack surface
Reachable over the network via HTTP requests to a Starlette-based service; the CVSS vector indicates no privileges and no user interaction are required. Exploitation depends on the application relying on request.url rather than the raw scope path for security decisions.
Exploitation
CISA added this to KEV on 2026-09-02 with a due date of 2026-09-16, and EPSS shows a 30-day probability of 0.36257 (98.399th percentile). Multiple references are tagged Exploit, indicating public exploit material exists.
What to do
- Upgrade Starlette to version 1.0.1 or later, which validates the Host header against RFC 9112 §3.2 / RFC 3986 §3.2.2 and falls back to scope["server"] for malformed values.
- Apply the vendor and Red Hat errata listed in the references for affected products such as OpenShift AI, Satellite, Ansible Automation Platform and Enterprise Linux AI.
- Where immediate upgrade is not possible, review middleware and endpoints that make security decisions from request.url and change them to use the raw scope path.
- Follow CISA BOD 26-04 guidance and the KEV required action, including evaluating internet exposure and discontinuing use if mitigations are unavailable.
Detection
- Inspect HTTP request logs for malformed or non-conforming Host header values, including values that do not match RFC 9112 §3.2 / RFC 3986 §3.2.2 grammar.
- Alert on requests where the logged Host header and the actual requested path or server scope disagree, which may indicate attempts to desynchronize request.url.path.
- Monitor for access to restricted routes or resources from requests whose Host header is anomalous, especially on Starlette-based services.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2026-48710 to the Known Exploited Vulnerabilities catalog on 2 September 2026 as "Kludex Starlette HTTP Request/Response Smuggling Vulnerability". Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal deadline 16 September 2026.
Affected products
8 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2026-48710 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2026-48710), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
