CVE-2026-48710: Kludex Starlette HTTP Request/Response Smuggling Vulnerability
Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271.
Overview
Starlette, the Python ASGI framework underlying FastAPI and much of the Python AI/LLM infrastructure, fails to validate the HTTP Host header before using it to reconstruct request.url. An unauthenticated remote attacker can send a crafted request with a malformed Host header containing path-separator characters, causing the framework's URL object to report a different path than the one actually routed. Any middleware that enforces authentication or authorization by reading request.url.path can be bypassed entirely, exposing protected endpoints without credentials. Versions before 1.0.1 are affected, as are downstream Red Hat products that bundle the vulnerable library.
Vulnerability details
Starlette builds request.url by concatenating the raw Host header with the request path as a string, then re-parsing the result. Because the Host header is not validated against RFC 9112 or RFC 3986 grammar, characters such as /, ?, and # in the header shift the parsed path boundary. The router dispatches on the real wire path from the ASGI scope, while middleware reads the poisoned request.url.path derived from the malformed header. These two values diverge, creating an inconsistent interpretation of the same HTTP request across different layers of the application.
An attacker sends an ordinary HTTP request to a protected endpoint while supplying a Host header that injects a benign-looking path prefix, for example a value containing a path and query separator. The router delivers the request to the real protected endpoint, but middleware performing path-based access control sees the attacker-controlled fake path and permits the request through. The CISA KEV listing notes this could be chained with CVE-2026-42271. Successful exploitation can yield access to admin panels, API key management surfaces, model control endpoints, and internal tooling. Where gated endpoints expose tool execution or code evaluation, secondary consequences can include SSRF or remote code execution.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Audit application and proxy access logs for HTTP requests where the Host header contains literal /, ?, or # characters outside the hostname and optional port fields. Legitimate clients do not send such values; any occurrence is anomalous and warrants investigation.
- Compare ASGI server access log entries for requests to protected path prefixes (such as /admin, /metrics, /internal, or /v1/models) that returned 2xx responses against authentication or session logs. A 2xx response to a protected path with no corresponding authenticated session record indicates a potential bypass.
- Run static analysis (Semgrep rules or CodeQL queries published by X41 D-Sec) against any Python codebase using Starlette or FastAPI to identify middleware that reads request.url.path for access-control decisions, flagging code paths that do not also check request.scope.
Remediation
Additional hardening
- Upgrade Starlette to version 1.0.1 or later. For Red Hat OpenShift AI, upgrade to 3.3.5 or 3.4.2 depending on your release line; for Migration Toolkit for Applications, upgrade to 8.2.0 or later. Consult the vendor advisory in References for other affected Red Hat products.
- Place an RFC-compliant reverse proxy (nginx, Caddy, Traefik, or HAProxy) in front of every ASGI server. These proxies reject or normalize malformed Host headers before forwarding, neutralizing the injection for deployments that cannot patch immediately.
- Replace request.url.path with request.scope["path"] in all middleware that makes authentication, authorization, rate-limiting, or audit decisions. The scope path comes from the HTTP request line and cannot be manipulated via the Host header.
- Prefer endpoint-level access controls (FastAPI Depends/Security decorators or Starlette requires()) over path-prefix middleware. Endpoint-bound controls operate on the routed destination, not the reconstructed URL, and are not affected by Host header manipulation.
Key dates
References
- https://badhost.org
- https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6
- https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette
- https://www.secwest.net/starlette
- https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette
- https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
Frequently asked questions
Does CVE-2026-48710 affect my FedRAMP authorization?
If Kludex Starlette runs inside your authorization boundary, CVE-2026-48710 is a direct concern for your Federal Risk and Authorization Management Program (FedRAMP) authorization. CISA has listed this vulnerability in the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of September 16, 2026. An unpatched KEV within your boundary is an assessor finding: you must remediate it or formally document a mitigation before your assessor and sponsoring agency raise it.
How does Knox help me handle CVE-2026-48710?
Knox does not patch your software. Remediating Kludex Starlette is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, plus continuous compliance monitoring and audit-artifact coverage to document the fix for your next assessment. The work of applying the patch is yours; managing your compliance posture while you do it is not something you handle alone.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on an ongoing basis. For a CVE like CVE-2026-48710, that means exposure surfaces during continuous monitoring rather than only when an assessor flags it at review time, giving you more time to act.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
What happens if CVE-2026-48710 isn't remediated by September 16, 2026?
An unremediated CVE-2026-48710 becomes a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing the item out and documenting the remediation is what keeps your authorization and the agency relationship in good standing.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
