CVE-2026-48710 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-05-26

Added to CISA KEV: 2026-09-02 99 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

⚠️ CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity before patching
CRITICAL: This vulnerability is in the CISA KEV catalog (active exploitation). Immediately review web/proxy logs for anomalous or malformed Host header values, check for unauthorized access to restricted/admin endpoints, and verify application integrity.
Upgrade Starlette to >= 1.0.1 (which validates the Host header against RFC 9112 §3.2 / RFC 3986 §3.2.2). For Red Hat products, apply the relevant RHSA errata (e.g., RHSA-2026:34456/60520 for OpenShift AI, RHSA-2026:22992/22993 for Satellite, RHSA-2026:24866/23346 for AAP).
Mitigate immediately by placing an RFC-compliant reverse proxy (nginx, Apache, HAProxy, Caddy) in front of the ASGI server to reject malformed Host headers; update any custom middleware to use request.scope['path'] instead of request.url.path for security decisions.
Deploy detection: monitor and alert on malformed/injected Host headers and requests that reach restricted paths; run BadHost scanners against your own estate to identify vulnerable services.
Patch priority: HIGH / URGENT for all internet-facing Starlette/FastAPI deployments and embedded products due to KEV listing and unauthenticated exploitability.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-48710 is a critical security-desynchronization vulnerability in Starlette, a lightweight Python ASGI framework, affecting versions prior to 1.0.1 ^[1]^[2]. The vulnerability occurs because the framework fails to validate the HTTP `Host` request header before using it to reconstruct the `request.url` object ^[2]. By injecting specific delimiters into the `Host` header, an attacker can manipulate how the application parses the URL path, effectively bypassing path-based security checks and access-control decorators ^[1].

Exploitation

Active Exploitation: There are no widely reported instances of massive active exploitation in the wild, though security researchers have identified the flaw as a significant risk for bypass-based attacks ^[4].
Threat Actors: As of September 2026, no specific ransomware campaigns or advanced persistent threat (APT) groups have been explicitly linked to the exploitation of this vulnerability.
Proof-of-Concept: Public proof-of-concept scanners and scripts (e.g., "BadHost" detection tools) are available on platforms like GitHub to help identify vulnerable deployments ^[5].
Prerequisites: Exploitation is performed over the network. It does not require local access or specific user interaction, and authentication can often be bypassed entirely if the security controls rely on the affected path-parsing logic ^[1].

Affected Products & Patches

Affected Versions: Starlette versions >= 0.8.3 and < 1.0.1 are affected ^[1].
Patch Availability: The maintainers have released version 1.0.1, which includes the necessary validation for the `Host` header ^[2].
Mitigations: If upgrading is not immediately possible, operators should configure a reverse proxy or middleware to reject or normalize malformed `Host` headers in compliance with RFC 9112 and RFC 3986 ^[3]. Additionally, logging and monitoring for anomalous `Host` header values can help detect attempted exploitation ^[3].

Impact

Access and Capability: Successful exploitation allows unauthorized access to restricted endpoints, bypassing path-based security middleware and access-control decorators intended to protect sensitive application functionality ^[1].
Business Risk: For internet-facing deployments, this vulnerability presents a significant risk of unauthorized data access, privilege escalation, or administrative function manipulation, as it effectively invalidates the primary security layer for many web-based APIs and services.

Sources

CVE-2026-48710: CVE-2026-48710: Starlette BadHost HTTP Host-Header Path ...
CVE-2026-48710 is a critical security-desynchronization vulnerability in the Starlette ASGI framework (versions >= 0.8.3, < 1.0.1) that allows remote attackers to bypass path-based security middleware and access-control decorators. By injecting URI authority-to-path delimiters into the Host header,…
NVD-CVE-2026-48710 - NIST
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used ...
CVE-2026-48710 - Vulnerability Details - OpenCVE
If upgrading is not immediately possible, employ a reverse proxy or middleware that rejects or normalizes malformed Host headers according to RFC 9112 and RFC 3986. Implement monitoring or logging for anomalous Host header values to detect attempted bypasses. Generated by OpenCVE AI on September 4,…
Starlette (Python ASGI Framework) prior to version 1.0.1
CVE-2026-48710, dubbed "BadHost," is a Host header authentication bypass vulnerability in Starlette, the lightweight Python ASGI framework ...
Bhanunamikaze/BadHost-CVE-2026-48710-Exploit: ...
CVE-2026-48710 Scanner Detection-only scanner for the BadHost auth-bypass in Starlette … allowing a crafted Host header to smuggle an allowlisted path and ...

🔴 CVE-2026-48710