Cyber & AI intelligence
Wasteland.
Briefs indexed2377
Issues26
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-48710 2026-09-02

CVE-2026-48710: Starlette Host Header Flaw Enables Path Injection and Auth Bypass

"CISA added CVE-2026-48710 to the Known Exploited Vulnerabilities catalog on 2026-09-02, flagging a request/response smuggling weakness in the Starlette ASGI framework that can bypass URL-based authentication checks."

CISA added CVE-2026-48710 to the Known Exploited Vulnerabilities catalog on 2026-09-02, flagging a request/response smuggling weakness in the Starlette ASGI framework that can bypass URL-based authentication checks.

What Is It

Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP Host request header was not validated before being used to reconstruct request.url. Because the routing algorithm relies on the raw HTTP path while request.url is rebuilt from the Host header, a malformed header could make request.url.path differ from the path that was actually requested.

CISA classifies the issue as HTTP request/response smuggling (CWE-444), describing it as allowing attackers to inject paths into the host part, prepending the actual path. NVD scores it CVSS 3.1 6.5 (MEDIUM), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. CISA notes it could be chained with CVE-2026-42271.

Why It Matters

Middleware and endpoints that apply security restrictions based on request.url, rather than the raw scope path; can be bypassed. Per CISA, that leads to issues such as authentication bypass when authentication depends on the reconstructed URL's path. The attack is network-reachable with no privileges and no user interaction.

KEV inclusion confirms this is a known exploited vulnerability. Known ransomware campaign use is listed as Unknown, and forensic triage is marked "No."

What's Vulnerable

CISA notes the flaw affects an open-source component that may be embedded in many different products.

Patch Status

Upgrade to Starlette 1.0.1 or later. That release validates the Host header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing request.url and falls back to scope["server"] for malformed values.

CISA's required action: apply mitigations per vendor instructions in line with BOD 26-04 and CISA's Forensics Triage Requirements; follow applicable BOD 26-04 guidance for cloud services or discontinue use if mitigations are unavailable. Due date: 2026-09-16.

Sources