CVE-2026-48710
published 2026-05-26CVE-2026-48710: Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct…
PriorityP185medium6.5CVSS 3.1
AVNACLPRNUINSUCLILAN
KEVITWEXPLOITRansomwareInitial access
CISA Known Exploited Vulnerabilitydue 2026-09-16
Exploited in the wild
EPSS
36.26%
98.4th percentile
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.
Affected
83 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-25 | lightspeed-chatbot-rhel8 | — | — |
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| encode | starlette | >= 0 < 1.0.1 | 1.0.1 |
| encode | starlette | >= 0.8.3 < 1.0.1 | 1.0.1 |
| exploit-intelligence-tech-preview | vulnerability-analysis-rhel9 | — | — |
| kludex | starlette | < 1.0.1 | 1.0.1 |
| mta | mta-solution-server-rhel9 | — | — |
| openshift-lightspeed | lightspeed-ocp-rag-rhel9 | — | — |
| openshift-lightspeed | lightspeed-service-api-rhel9 | — | — |
| redhat | ai_inference_server | 3.3.0 – 3.3.5 | — |
| redhat | ansible_automation_platform | — | — |
| redhat | ansible_automation_platform | — | — |
| redhat | enterprise_linux_ai | — | — |
| redhat | migration_toolkit_for_applications | < 8.2.0 | 8.2.0 |
| redhat | openshift_ai | >= 3.3 < 3.3.5 | 3.3.5 |
| redhat | openshift_ai | >= 3.4 < 3.4.2 | 3.4.2 |
| redhat | satellite | — | — |
| redhat | satellite | — | — |
| redhat | satellite | — | — |
| rhaii | vllm-cpu-rhel9 | — | — |
| rhaii | vllm-cuda-rhel9 | — | — |
| rhaii | vllm-gaudi-rhel9 | — | — |
| rhaii | vllm-neuron-rhel9 | — | — |
| rhaii | vllm-rocm-rhel9 | — | — |
| rhaii | vllm-spyre-rhel9 | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
vulncheck6.5MEDIUM
cisa8.8HIGH
vendor_redhat6.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
ghsa·2026-06-04
CVE-2026-48710 [MEDIUM] CWE-444 Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
### Summary
In affected versions, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed.
### Details
When a client requests `http://example.com/foo`, it sends:
```http
GET /foo HTTP/1.1
Host: example.com
```
Affected versions reconstructed the URL by concatenating `http://{host}{path
VulDB
Kludex starlette up to 1.0.0 Request Header request smuggling (GHSA-86qp-5c8j-p5mr / Nessus ID 316593)
vuldb·2026-05-29·CVSS 6.5
CVE-2026-48710 [MEDIUM] Kludex starlette up to 1.0.0 Request Header request smuggling (GHSA-86qp-5c8j-p5mr / Nessus ID 316593)
A vulnerability was found in Kludex starlette up to 1.0.0. It has been rated as critical. This impacts an unknown function of the component Request Header Handler. This manipulation causes http request smuggling.
The identification of this vulnerability is CVE-2026-48710. It is possible to initiate the attack remotely. There is no exploit available.
Upgrading the affected component is advised.
VulnCheck
encode starlette Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
vulncheck·2026·CVSS 6.5
CVE-2026-48710 [MEDIUM] encode starlette Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
encode starlette Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when cons
CISA
Kludex Starlette HTTP Request/Response Smuggling Vulnerability
cisa·2026-09-02·CVSS 8.8
CVE-2026-48710 [HIGH] CWE-444 Kludex Starlette HTTP Request/Response Smuggling Vulnerability
Vulnerability: Kludex Starlette HTTP Request/Response Smuggling Vulnerability
Affected: Kludex Starlette
Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are
Red Hat
starlette: Starlette: Security restriction bypass via malformed HTTP Host header
vendor_redhat·2026-05-26·CVSS 6.5
CVE-2026-48710 [MEDIUM] CWE-1289 starlette: Starlette: Security restriction bypass via malformed HTTP Host header
starlette: Starlette: Security restriction bypass via malformed HTTP Host header
A flaw was found in Starlette, a lightweight ASGI (Asynchronous Server Gateway Interface) framework. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP `Host` request header. This malformed header could cause the `request.url` to be incorrectly reconstructed, leading to a discrepancy with the actual requested path. Consequently, security restrictions enforced by middleware and endpoints that rely on `request.url` for validation could be bypassed, potentially allowing unauthorized access or actions.
Package: exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 (Exploit Intelligence) - Affected
Package: mta/mta-solution-server-rhel9 (Migration Toolkit for Applicat
No detection rules found.
Nuclei
Starlette - Improper Validation of Unsafe Equivalence in Input
nuclei·CVSS 6.5
CVE-2026-48710 [MEDIUM] Starlette - Improper Validation of Unsafe Equivalence in Input
Starlette - Improper Validation of Unsafe Equivalence in Input
A flaw was found in Starlette, a lightweight ASGI (Asynchronous Server Gateway Interface) framework. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP Host request header. This malformed header could cause the request.url to be incorrectly reconstructed, leading to a discrepancy with the actual requested path. Consequently, security restrictions enforced by middleware and endpoints that rely on request.url for validation could be bypassed, potentially allowing unauthorized access or actions.
Template:
id: CVE-2026-48710
info:
name: Starlette - Improper Validation of Unsafe Equivalence in Input
author: ritikchaddha
severity: critical
description: |
A flaw was found in Starlette, a lightwe
Nuclei
LiteLLM - Command Injection
nuclei·CVSS 8.7
CVE-2026-42271 [HIGH] LiteLLM - Command Injection
LiteLLM - Command Injection
A critical unauthenticated remote code execution vulnerability exists in LiteLLM due to improper input handling in the MCP stdio test endpoint. An attacker can send a specially crafted request to the `/mcp-rest/test/connection` endpoint with controlled parameters, resulting in arbitrary command execution on the server. When combined with an authentication bypass technique—such as the Starlette BadHost flaw (CVE-2026-48710)—an unauthenticated attacker can exploit the chain to execute commands as the server process. Exploitation allows an attacker to spawn processes with the privileges of the LiteLLM server, potentially leading to complete compromise of the host.
Template:
id: CVE-2026-42271
info:
name: LiteLLM - Command Injection
author: ritikchaddha
severity
Hackernews
CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners
blogs_hackernews·2026-09-03·CVSS 6.5
CVE-2026-83548 [MEDIUM] CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added seven security flaws to its Known Exploited Vulnerabilities ( KEV ) catalog after they landed in attackers' crosshairs.
The vulnerabilities are as follows -
CVE-2026-83548 (CVSS score: 10.0) - A server-side request forgery vulnerability in SonicWall SMA 1000 Appliances that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations.
CVE-2026-83549 (CVSS score: 7.8) - A post-authen
Wiz
Inside 90 days of attacks on AI infrastructure
blogs_wiz·2026-08-27
CVE-2026-59822 Inside 90 days of attacks on AI infrastructure
Wiz Threat Research operates honeypots across AI and ML services including LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama, and others. Over 90 days of telemetry, we observed sustained attack activity against AI infrastructure, with tooling adapted to the specific internals of each service. We’re sharing our findings with the community so that organizations can defend themselves against the techniques we’ve observed so far.
The findings below are organized around three attack patterns:
Exploiting Internet-facing MCP servers for remote code execution
Blind prompt injection against AI agent frameworks
AI-native post-exploitation, with tooling adapted specifically to AI infrastructure internals
## Why AI infrastructure matters as a cloud attack surface
Wiz’s State of AI in the C
Microsoft
When AI infrastructure becomes the target: Securing gateways and control points
blogs_microsoft·2026-08-26
CVE-2026-42271 When AI infrastructure becomes the target: Securing gateways and control points
## Combined high-signal secret-discovery triage
This combined query is useful for triage dashboards or incident review because it labels each result with a detection reason. Analysts can use the DetectionReason field to quickly separate direct environment access, LiteLLM-specific secret discovery, Python database credential access, and shell-based searching.
// Combined triage query using only high-confidence secret-discovery signals.
DeviceProcessEvents
| where isnotempty(ProcessCommandLine)
| extend Cmd = tolower(ProcessCommandLine)
| extend DetectionReason = case(
Cmd contains "/proc/1/environ", "Direct access to PID 1 environment variables",
Cmd has_any ("litellm", "litellm_proxymodeltable", "litellm_verificationtoken", "proxymodeltable", "verificationtoken") and Cmd has_any ("datab
Hackernews
LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE
blogs_hackernews·2026-06-09·CVSS 8.8
CVE-2026-42271 [HIGH] LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity flaw impacting BerriAI LiteLLM to its Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation.
The vulnerability, tracked as CVE-2026-42271 (CVSS score: 8.7), is a command injection vulnerability that could allow any authenticated user to run arbitrary commands on the host.
It affects the following version of the LiteLLM Python package -
>= 1.74.2
< 1.83.7
"Two endpoints used to preview an MCP server before saving
Bugzilla
CVE-2026-48710 starlette: Starlette: Security restriction bypass via malformed HTTP Host header
bugzilla·2026-05-26·CVSS 6.5
CVE-2026-48710 [MEDIUM] CVE-2026-48710 starlette: Starlette: Security restriction bypass via malformed HTTP Host header
CVE-2026-48710 starlette: Starlette: Security restriction bypass via malformed HTTP Host header
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constr
https://badhost.orghttps://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mrhttps://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yamlhttps://ostif.org/disclosing-the-badhost-vulnerability-in-starlettehttps://www.secwest.net/starlettehttps://www.x41-dsec.de/lab/advisories/x41-2026-002-starlettehttps://access.redhat.com/errata/RHSA-2026:22992https://access.redhat.com/errata/RHSA-2026:22993https://access.redhat.com/errata/RHSA-2026:23346https://access.redhat.com/errata/RHSA-2026:24866https://access.redhat.com/errata/RHSA-2026:26226https://access.redhat.com/errata/RHSA-2026:30088https://access.redhat.com/errata/RHSA-2026:30089https://access.redhat.com/errata/RHSA-2026:34456https://access.redhat.com/errata/RHSA-2026:34526https://access.redhat.com/errata/RHSA-2026:34532https://access.redhat.com/errata/RHSA-2026:37275https://access.redhat.com/errata/RHSA-2026:43038https://access.redhat.com/errata/RHSA-2026:44696https://access.redhat.com/errata/RHSA-2026:51357https://access.redhat.com/errata/RHSA-2026:60520https://access.redhat.com/errata/RHSA-2026:63337https://access.redhat.com/security/cve/CVE-2026-48710https://bugzilla.redhat.com/show_bug.cgi?id=2481742https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.jsonhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48710https://www.wiz.io/blog/ai-infrastructure-honeypothttps:/www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points
2026-05-26
Published
2026-09-02
Added to CISA KEV
Exploited in the wild