Starlette URL bypass actively exploited (CVE-2026-48710) [PoC]

Actively exploited in the wild - CVE-2026-48710 is a medium security-control bypass in Starlette prior to 1.0.1 that lets attackers evade authentication and authorization checks built on request.url. Patched in 1.0.1, which validates the Host header; update immediately.

Overview

Starlette is a widely used lightweight ASGI framework and toolkit that underpins many popular Python web applications. CVE-2026-48710 stems from inconsistent handling of two URL representations. The routing algorithm inspects the raw HTTP path from the request scope, while request.url is reconstructed from the Host header. Because version 1.0.0 and earlier did not validate the Host header’s grammar, an attacker could send a malformed value that causes request.url.path to diverge from the path actually processed by the router.

This divergence is not merely cosmetic. Frameworks and applications commonly enforce security restrictions - such as authentication gates, CSRF protection, or admin-panel access rules - by inspecting request.url. When an attacker crafts a Host header that alters the reconstructed URL path, those middleware layers can be tricked into treating a restricted request as benign or as targeting a different, allowed endpoint. The request still executes against the real path, which means the security control is silently bypassed.

Impact

The vulnerability has a CVSS score of 6.5 (medium), with a network attack vector and no prerequisites such as authentication or user interaction. The practical consequence is that any Starlette application relying on request.url for security decisions is exposed to authorization and policy bypasses. Because Starlette forms the foundation of frameworks such as FastAPI, the affected user base is significant. The CISA Known Exploited Vulnerabilities catalog confirms active exploitation in the wild, and the EPSS model estimates a 2.1 percent probability of exploitation within 30 days.

Remediation

Upgrade Starlette to version 1.0.1 or later. The fix validates the Host header against the grammar defined in RFC 9112 Section 3.2 and RFC 3986 Section 3.2.2 when constructing request.url, and falls back to the trusted scope["server"] value for malformed headers.

For applications that cannot upgrade immediately, audit all middleware and endpoint code that uses request.url for access decisions and re-implement those checks against the raw scope["path"] value instead. A Web Application Firewall rule that treats malformed Host headers as suspicious can provide interim protection.

For ongoing visibility into this and related threats, review breach reports and follow security news for updates.

Security Insight

CVE-2026-48710 illustrates a recurring class of vulnerability where frameworks expose two representations of the same request that can be made to disagree. The Host header has historically been a trust boundary that developers assume is safe, yet RFC-compliant validation was missing here precisely because the assumption was baked into the URL-construction logic. This mirrors similar Host-header poisoning flaws in other web frameworks over the past decade, and it reinforces that security decisions should always derive from one canonical, validated source of truth - not from convenience properties that reconstruct data from attacker-controlled input.

Further Reading

• All Medium Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs