Starlette is a lightweight ASGI framework/toolkit.

CVE-2026-48710, dubbed BadHost, is a Host header validation bypass in Starlette versions 0.8.3 through 1.0.0 (fixed in 1.0.1). Starlette reconstructs request.url by concatenating the raw HTTP Host header with the request path — f"{scheme}://{host_header}{path}" — without validating the Host value against RFC 9112 / RFC 3986. By injecting a ?, #, or / into the Host header, an attacker makes request.url.path resolve to / (a public route) while the ASGI router still dispatches the request to the *actual* target path (e.g., /admin). Any middleware or endpoint that gates access using request.url.path instead of scope['path'] is instantly bypassed. Because Starlette underpins FastAPI (490M+ monthly PyPI downloads), vLLM, LiteLLM, and most MCP servers, the blast radius is enormous.

The vendor scored this MEDIUM 6.5, which dramatically undersells the real-world risk. The standalone CVSS assessment captures only Confidentiality:Low / Integrity:Low, treating it as a generic information-disclosure-class bug. In practice, the exploit is unauthenticated, requires zero user interaction, works with a single curl command, is KEV-listed as of September 2, 2026, and is already being chained in the wild with CVE-2026-42271 to achieve unauthenticated RCE against LiteLLM gateways — delivering XMRig cryptominers, harvesting secrets from PostgreSQL, and establishing persistence. Microsoft Threat Intelligence published a detailed write-up of the campaign. The vendor MEDIUM label is dangerously wrong for any team running Starlette-based services that are network-reachable.

Why this verdict

• Trivial exploitability: One-line curl command, unauthenticated, no user interaction. Attack complexity is effectively zero for any exposed Starlette service without a normalizing reverse proxy.
• KEV + active campaigns: CISA added this to KEV on 2026-09-02 citing active exploitation. Microsoft documented real-world campaigns chaining BadHost with CVE-2026-42271 for RCE, cryptomining, and credential harvesting against LiteLLM gateways.
• Massive installed base: Starlette is the ASGI layer under FastAPI (490M+ monthly PyPI downloads), vLLM, LiteLLM, and MCP servers. The affected population is not a niche product — it is core AI/ML infrastructure.
• Role multiplier: Starlette/FastAPI is canonically deployed as (c) high-value roles: LLM inference gateways (LiteLLM, vLLM) that hold API keys and model access, MCP agent control planes, and internal API tiers that front production databases. Auth bypass on an LLM gateway yields access to all configured provider API keys, model configurations, and connected data stores. The documented chain ends in full host compromise + secret harvesting + lateral movement — blast radius is host-to-fleet. Because Starlette *is* the framework for these high-value roles (not an incidental dependency), >=10% of Starlette installs occupy high-value positions. Verdict floor: HIGH.
• Friction offset (partial): Reverse proxies (nginx, Envoy, Cloudflare) that normalize Host headers do block the attack. This prevents an upgrade to CRITICAL because a meaningful fraction of production deployments sit behind such proxies. However, dev/staging instances, directly-exposed uvicorn services, and internal network services often lack this protection.

Why not higher?

The standalone vulnerability is an authentication bypass, not direct remote code execution. Achieving RCE requires chaining with a second vulnerability (e.g., CVE-2026-42271 in LiteLLM). Additionally, well-configured reverse proxies that validate Host headers per RFC 9112 neutralize the attack entirely. The CVSS impact is C:L/I:L/A:N for the standalone flaw, and the blast radius requires a secondary bug to reach fleet-scale compromise.

Why not lower?

KEV listing with documented active exploitation campaigns immediately disqualifies MEDIUM or below. The exploit is unauthenticated, requires zero complexity, has public PoC tooling and dedicated scanners, and affects the most popular Python web framework ecosystem. The high-value deployment roles (LLM gateways, AI agent infrastructure) mean the auth bypass alone exposes API keys, model configs, and internal endpoints even without chaining for RCE.

1. Deploy or verify Host header validation on your reverse proxy — Configure nginx (server_name directive with strict matching), Envoy (strict host matching in route config), or Cloudflare (managed rules) to reject or normalize Host headers containing ?, #, or / characters before traffic reaches Starlette. This is the most effective immediate mitigation — deploy within 3 days per noisgate mitigation SLA since this is KEV-listed with active exploitation, overriding the standard 30-day HIGH timeline.
2. Audit middleware auth logic for request.url.path usage — Search your codebase for request.url.path or request.url in authorization checks. Replace with request.scope['path'] which uses the raw ASGI path unaffected by Host header manipulation. Semgrep rule: pattern: request.url.path. Deploy code changes within the mitigation window.
3. Pin starlette>=1.0.1 in all requirements files — Run pip install --upgrade starlette>=1.0.1 across all environments. For FastAPI projects, verify the resolved Starlette version with pip show starlette. For LiteLLM, upgrade to >=1.83.7. Prioritize internet-facing and LLM gateway deployments first.
4. Monitor for Host header anomalies in access logs — Create SIEM alerts for HTTP requests where the Host header contains ?, #, or path separators. Correlate with successful (2xx) responses to admin or protected endpoints. This provides detection coverage while patching is in progress.

Run this script on any host with pip access to check installed Starlette versions. Execute as the same user that runs your Python applications: bash check_badhost.sh. No elevated privileges required.

#!/usr/bin/env bash
# check_badhost.sh — Detect CVE-2026-48710 (BadHost) in installed Starlette
# Usage: bash check_badhost.sh
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

VULN_CVE="CVE-2026-48710"
FIXED_VERSION="1.0.1"

echo "[*] Checking for $VULN_CVE (Starlette BadHost)"

# Check if pip is available
if ! command -v pip &>/dev/null && ! command -v pip3 &>/dev/null; then
  echo "UNKNOWN — pip not found. Check Python environments manually."
  exit 2
fi

PIP_CMD=$(command -v pip3 2>/dev/null || command -v pip 2>/dev/null)

# Get installed starlette version
INSTALLED=$($PIP_CMD show starlette 2>/dev/null | grep -i '^Version:' | awk '{print $2}')

if [ -z "$INSTALLED" ]; then
  echo "UNKNOWN — starlette is not installed in this Python environment."
  echo "[*] Check other virtualenvs: find / -name 'starlette' -path '*/site-packages/*' 2>/dev/null"
  exit 2
fi

echo "[*] Installed starlette version: $INSTALLED"
echo "[*] Fixed version: >= $FIXED_VERSION"

# Compare versions using sort -V
LOWEST=$(printf '%s\n%s\n' "$INSTALLED" "$FIXED_VERSION" | sort -V | head -n1)

if [ "$LOWEST" = "$FIXED_VERSION" ] || [ "$INSTALLED" = "$FIXED_VERSION" ]; then
  echo "PATCHED — starlette $INSTALLED >= $FIXED_VERSION"
  exit 0
else
  echo "VULNERABLE — starlette $INSTALLED < $FIXED_VERSION"
  echo "[!] Upgrade immediately: pip install 'starlette>=$FIXED_VERSION'"
  exit 1
fi

Sources

1. Snyk Vulnerability Database — SNYK-PYTHON-STARLETTE-16881242
2. Horizon3.ai — CVE-2026-42271 Chained with CVE-2026-48710
3. CISA KEV Addition — September 2, 2026
4. Microsoft Threat Intelligence — Securing AI Gateways
5. Oligo Security — LiteLLM RCE Detection and Blocking
6. The Hacker News — LiteLLM Flaw Exploited in the Wild
7. BadHost PoC and Exploit Repository
8. Belgium CCB Advisory — Starlette Framework Vulnerability