The US cybersecurity agency CISA added CVE-2026-48710, a vulnerability in the widely used Python framework Starlette, to its Known Exploited Vulnerabilities (KEV) catalog on September 2, 2026. Attackers are already abusing the flaw in the wild to bypass authentication checks.
A tampered Host header poisons the path
At the heart of the issue is missing validation of the HTTP Host header. Starlette assembles the request.url property from the attacker-controllable Host header and the request path, then re-parses the result. As a consequence, request.url.path can diverge from the path the ASGI server actually uses for routing. If a middleware evaluates access rights based on request.url.path, it assesses a forged path while the genuinely protected route still executes in the background.
The result is an authentication bypass for unauthenticated attackers over the network. The CWE-444 flaw (HTTP request smuggling) carries a CVSS score of 6.5, rated medium. Its reach is nonetheless considerable, because Starlette underpins the popular FastAPI web framework and sits inside countless production APIs.
Apply the update to version 1.0.1
The maintainers fixed the flaw in Starlette 1.0.1. That release validates the Host header against RFC 9112 and RFC 3986 and falls back to scope["server"] for invalid values. Operators should update promptly; researchers note the flaw can be chained with CVE-2026-42271 for remote code execution against LiteLLM instances. CISA requires US federal agencies to remediate the vulnerability by September 16, 2026.
Sources: CISA KEV Alert · GitLab Advisory Database · The Hacker News
