CVE-2026-48710Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
Updated under an hour ago ()
Does this affect you?
It affects Kludex starlette and 10 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Sep 2, 2026; federal agencies had to remediate by Sep 16, 2026. Treat that date as your deadline.
Do this next
Free account, 1 product
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.
- CVSS
- 6.5 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness (CWE)
- CWE-444, CWE-1289
- Known exploited
- Added to CISA KEV Sep 2, 2026; federal remediation due Sep 16, 2026Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- EPSS (exploitation in the next 30 days)
- 7.06% (percentile 94)
- Assigned by
- GitHub_M
- NVD analysis
- Analyzed
- Record last updated
- Oct 1, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Kludex starlette kludex:starlette (from the name) | before 1.0.1 | CNA record |
Red Hat Red Hat AI Inference Server 3.3 redhat:ai_inference_server | from 1782353093 not affected | CISA ADP |
Red Hat Red Hat Ansible Automation Platform 2.6 redhat:ansible_automation_platform | from 1780102732 not affected | CISA ADP |
Red Hat Red Hat Migration Toolkit for Applications 8.2 redhat:migration_toolkit_applications | from 1784109883 not affected | CISA ADP |
Red Hat Red Hat OpenShift AI 3.3 redhat:openshift_ai | from 1782997656 not affected | CISA ADP |
Red Hat Red Hat Satellite 6.17 redhat:satellite | from 1784834402 not affected | CISA ADP |
Red Hat Exploit Intelligence redhat:exploit_intelligence | 0 | CISA ADP |
Red Hat OpenShift Lightspeed redhat:openshift_lightspeed | All versions | CISA ADP |
Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3 redhat:enterprise_linux_ai | 3 | CISA ADP |
encode starlette encode:starlette | from 0.8.3 before 1.0.1 | NVD |
redhat ai_inference_server redhat:ai_inference_server | from 3.3.0 through 3.3.5 | NVD |
redhat ansible_automation_platform redhat:ansible_automation_platform | 2.6; 2.7 | NVD |
redhat migration_toolkit_for_applications redhat:migration_toolkit_for_applications | before 8.2.0 | NVD |
redhat openshift_ai redhat:openshift_ai | from 3.3 before 3.3.5; from 3.4 before 3.4.2 | NVD |
redhat openshift_lightspeed redhat:openshift_lightspeed | all versions | NVD |
redhat satellite redhat:satellite | 6.17; 6.18; 6.19 | NVD |
redhat enterprise_linux_ai redhat:enterprise_linux_ai | 3.0 | NVD |
References
- https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mrx-refsource-confirm, vendor-advisory
- https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6x-refsource-misc, patch
- https://badhost.orgx-refsource-misc, mitigation, third-party-advisory
- https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yamlx-refsource-misc, third-party-advisory
- https://ostif.org/disclosing-the-badhost-vulnerability-in-starlettex-refsource-misc, mitigation, third-party-advisory
- https://www.secwest.net/starlettex-refsource-misc, exploit, mitigation, third-party-advisory
- https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlettex-refsource-misc, exploit, mitigation, third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:22992third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:22993third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:23346third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:24866third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:26226third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:30088third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:30089third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:34456third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:34526third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:34532third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:37275third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:43038third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:44696third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:51357third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:60520third-party-advisory
- https://access.redhat.com/errata/RHSA-2026:63337third-party-advisory
- https://access.redhat.com/security/cve/CVE-2026-48710third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2481742issue-tracking, third-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.