CVE-2026-48710: Starlette "BadHost" Host-Header Path Smuggling (KEV)

CVE-2026-48710, nicknamed "BadHost", is a Host-header validation flaw in the Starlette ASGI framework: because request.url is rebuilt from the attacker-controlled Host header instead of the raw request path, a malformed Host header can make request.url.path show a different path than the one actually routed, letting an attacker smuggle a path past any middleware or endpoint that makes security decisions from request.url, and CISA's KEV catalog confirms it is being exploited.

CVE-2026-48710 is a Host-header validation flaw (CWE-444 HTTP Request/Response Smuggling, CWE-1289 Improper Validation of Unsafe Equivalence) in Starlette, the lightweight ASGI framework/toolkit that underlies FastAPI and many other Python web services. NVD's Analyzed description states: "the HTTP Host request header was not validated before being used to reconstruct request.url. Because the routing algorithm relies on the raw HTTP path while request.url is rebuilt from the Host header, a malformed header could make request.url.path differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on request.url (rather than the raw scope path) could therefore be bypassed" (NVD).

NVD published an independent Primary score of CVSS v3.1 6.5 (medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N — matching the CNA Secondary score submitted by GitHub, so both ratings agree (NVD).

The Kludex/Starlette security advisory, titled "Missing Host Header Validation Poisons request.url.path", walks through the mechanism: a request to a real path such as /foo sent with a crafted Host header like example.com/abc?bar= gets reconstructed into a URL whose path reads as /abc instead of /foo, because the /, ? and # characters in the Host header are reinterpreted as path/query/fragment delimiters when request.url is rebuilt. Any application code that trusts request.url.path for an authorization or routing decision — rather than the raw ASGI scope path Starlette actually dispatched on — can be bypassed this way. The fix, shipped in Starlette 1.0.1, validates the Host header against the RFC 9112 §3.2 / RFC 3986 §3.2.2 grammar before using it, and falls back to scope["server"] for malformed values (Starlette Security Advisory GHSA-86qp-5c8j-p5mr).

CISA added CVE-2026-48710 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-02 (catalog version 2026.10.28, 1762 entries, confirmed live this run), with a required-action due date of 2026-09-16; CISA's own vulnerability name calls it a "HTTP Request/Response Smuggling Vulnerability" and notes it "could be chained with CVE-2026-42271" to defeat authentication that depends on the reconstructed URL's path (CISA KEV). Because Starlette underlies FastAPI and is bundled into numerous downstream products, Red Hat alone shipped more than a dozen separate errata for this one CVE across its AI Inference Server and Ansible Automation Platform lines, per NVD's reference list (NVD).

As of 2026-10-28, FIRST scores the probability of exploitation at 0.70288 (99.381th percentile), a high score consistent with the KEV listing and the very wide deployment footprint of Starlette/FastAPI rather than any single targeted campaign (FIRST EPSS).

Any service built on Starlette 0.8.3 through 1.0.0 — directly or via FastAPI — should upgrade to 1.0.1 or later; teams that cannot upgrade immediately should audit any middleware that makes auth/security decisions from request.url rather than the raw ASGI scope path.

• Starlette through 1.0.0 does not validate the Host header before reconstructing request.url, letting a malformed Host header desync request.url.path from the actual request path and bypass path-based middleware/endpoint checks. — NVD
• NVD Primary CVSS v3.1 base score is 6.5 (medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, matching the CNA Secondary score. — NVD
• "BadHost": a Host header containing /, ? or # is reinterpreted as path/query/fragment delimiters, poisoning request.url.path; fixed in 1.0.1 by validating the Host header against RFC 9112/3986 grammar and falling back to scope["server"]. — Starlette Security Advisory GHSA-86qp-5c8j-p5mr
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-02 (catalog version 2026.10.28, 1762 entries), required-action due date 2026-09-16; CISA notes it could be chained with CVE-2026-42271. — CISA KEV
• EPSS score is 0.70288 (99.381th percentile) as of 2026-10-28. — FIRST EPSS