Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-48710

CVE-2026-48710MEDIUM

Kludex starlette — Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  L  L  N    6.5   .0706   94.0   YES

AFFECTED
  Product    Versions   Fixed
  starlette  < 1.0.1 –  —

TIMELINE
  May 22  Reserved by GitHub_M
  May 26  EXPLOIT PUBLISHED — CVE-2026-48710 (Kludex starlette). Public exploit reference added.
  May 26  Published (CNA: GitHub_M)
  Aug 10  EXPLOIT PUBLISHED — CVE-2026-48710 (Kludex starlette). Public exploit reference added.
  Aug 28  EXPLOIT PUBLISHED — CVE-2026-48710 (Kludex starlette). Public exploit reference added.
  Sep 2   EXPLOIT PUBLISHED — CVE-2026-48710 (Kludex starlette). Public exploit reference added.
  Sep 2   ADDED TO KEV — CVE-2026-48710 (Kludex starlette). Remediation due September 16, 2026.
  Sep 3   EXPLOIT PUBLISHED — CVE-2026-48710 (Kludex starlette). Public exploit reference added.
  Sep 4   EXPLOIT PUBLISHED — CVE-2026-48710 (Kludex starlette). Public exploit reference added.
  Sep 17  DUE DATE PASSED — CVE-2026-48710 (Kludex starlette). CISA remediation deadline was September 16, 2026; still in catalog.
  Oct 1   EXPLOIT PUBLISHED — CVE-2026-48710 (Kludex starlette). Public exploit reference added.

CWE-444, CWE-1289 · CNA: GitHub_M · CVSS v3.1 · 29 references · NVD status: Analyzed · KEV due September 16, 2026

Description

Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.

Lifecycle

Complete event history — 11 events, chronological
Date	Event	Detail
May 22, 2026	Reserved	Reserved by GitHub_M
May 26, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-48710 (Kludex starlette). Public exploit reference added.
May 26, 2026	Published	Published (CNA: GitHub_M)
August 10, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-48710 (Kludex starlette). Public exploit reference added.
August 28, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-48710 (Kludex starlette). Public exploit reference added.
September 2, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-48710 (Kludex starlette). Public exploit reference added.
September 2, 2026	KEV ADDED	ADDED TO KEV — CVE-2026-48710 (Kludex starlette). Remediation due September 16, 2026.
September 3, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-48710 (Kludex starlette). Public exploit reference added.
September 4, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-48710 (Kludex starlette). Public exploit reference added.
September 17, 2026	DUE DATE PASSED	DUE DATE PASSED — CVE-2026-48710 (Kludex starlette). CISA remediation deadline was September 16, 2026; still in catalog.
October 1, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-48710 (Kludex starlette). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Kludex	starlette	—	< 1.0.1	—

Weaknesses

CWE-444 · CWE-1289

References (29)

https://access.redhat.com/errata/RHSA-2026:22992 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2026:22993 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2026:23346 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2026:24866 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2026:26226 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2026:30088 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2026:30089 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2026:34456 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2026:34526 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2026:34532 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2026:37275 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2026:43038 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2026:44696 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2026:51357 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2026:60520 [Third Party Advisory]
https://access.redhat.com/errata/RHSA-2026:63337 [Third Party Advisory]
https://access.redhat.com/security/cve/CVE-2026-48710 [Third Party Advisory]
https://badhost.org [Mitigation, Third Party Advisory]
https://bugzilla.redhat.com/show_bug.cgi?id=2481742 [Issue Tracking, Third Party Advisory]
https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6 [Patch]
https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr [Vendor Advisory]
https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml [Third Party Advisory]
https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette [Mitigation, Third Party Advisory]
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json [Third Party Advisory]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48710 [Third Party Advisory, US Government Resource]
https://www.secwest.net/starlette [Exploit, Mitigation, Third Party Advisory]
https://www.wiz.io/blog/ai-infrastructure-honeypot [Exploit, Third Party Advisory]
https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette [Exploit, Mitigation, Third Party Advisory]
https:/www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points [Broken Link]

Authoritative record: CVE-2026-48710 at cve.org

Vendors: kludex

Weaknesses: CWE-444 · CWE-1289

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-48710 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.