CVE-2026-48710

What is Starlette?

Starlette is a lightweight ASGI web framework for Python and the foundation underneath FastAPI — one of the most-downloaded Python web stacks in the world — as well as AI-infrastructure projects like LiteLLM. A request-parsing flaw in Starlette therefore inherits the exposure of the entire downstream ecosystem: any FastAPI or Starlette application whose security decisions depend on the reconstructed request URL is in scope.

Overview

CVE-2026-48710, dubbed "BADHOST," is a request-smuggling-class flaw (CWE-444): Starlette rebuilds request.url by concatenating the attacker-controlled Host header with the request path, so a malicious Host value can poison request.url.path and desynchronize it from the path the router actually dispatches on. The practical impact is authentication bypass in middleware that gates access by path. It was exploited in the wild chained with LiteLLM's CVE-2026-42271 for unauthenticated remote code execution against AI gateways, and entered the CISA KEV catalog on 2026-09-02.

Affected Versions

Technical Details

Starlette's Request.url property concatenated the Host header with the request path and re-parsed the resulting string, without validating the Host value against the RFC 9112 / RFC 3986 grammars. By embedding /, ?, or # characters in the Host header, an attacker shifts the parsed path/query/fragment boundaries: request.url.path (what security middleware inspects) diverges from the raw wire path (what the ASGI router dispatches on). Middleware that allows or denies requests by path prefix can be shown an innocuous poisoned path while the protected route still executes.

The attack is a single unauthenticated request with low complexity. The fix in Starlette 1.0.1 validates the Host header and falls back to scope["server"] when the value is malformed. Scoring differs between sources: the KEV/NVD listing carries 6.5, the GitHub advisory 7.0 — the modest base score understates the real-world impact when path-based auth is the only gate, as the LiteLLM chain demonstrated.

Discovery

Found by X41 D-Sec during a security audit (advisory X41-2026-002) supported by OSTIF, and disclosed in coordination with Starlette maintainer Marcelo Trylesinski, who published a detailed maintainer's write-up. The GitHub advisory went out 2026-05-28.

Exploitation Context

In-the-wild exploitation was observed chained with CVE-2026-42271, an OS command injection in LiteLLM's MCP stdio test endpoint: BADHOST's path confusion made LiteLLM's vulnerable MCP test endpoints reachable without any API key, turning the pair into fully unauthenticated RCE against AI gateways. Horizon3.ai documented the chain in June 2026; Wiz honeypot telemetry tied the activity to actors associated with the Qilin (Agenda) ransomware ecosystem, with observed payloads including XMRig cryptominers. The Belgian CCB issued a national warning covering Starlette/FastAPI exposure.

Remediation

1. Upgrade Starlette to 1.0.1 or later, and rebuild/redeploy FastAPI, LiteLLM, and other dependent applications so the fixed version is actually in the environment (pip show starlette to verify). Federal deadline: 2026-09-16.
2. Treat path-prefix checks in middleware as untrustworthy on vulnerable versions — enforce authentication in route handlers or a fronting gateway, not solely by URL path.
3. At reverse proxies/load balancers, reject requests with malformed Host headers (containing /, ?, #, or whitespace) before they reach the application.
4. If you run LiteLLM, also confirm CVE-2026-42271 is patched — the two were exploited as a pair.
5. Review access logs for requests with anomalous Host headers and for hits on admin/MCP routes from unauthenticated sources.