CVE-2026-48710

GitHubCurated repository PoCScannerC++SecureWithUmer/CVE-2026-PoCs

PoC files

12 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A detection-only scanner for CVE-2026-48710 (BadHost) in Starlette/FastAPI. It sends crafted HTTP requests with malformed Host headers to test if authentication middleware can be bypassed, and reports differential findings without exploiting the vulnerability.

Backdoor review

No backdoor observed in reviewed code

The PoC is a detection-only scanner for CVE-2026-48710 (BadHost) in Starlette/FastAPI. It sends crafted HTTP requests to test for Host-header auth bypass and reports results. All reviewed source code, documentation, and lab files are consistent with a legitimate security testing tool. No concealed executable behavior, persistence, credential theft, unrelated payloads, or operator-directed harm was observed.

ClassificationScanner
Model confidence98%
AuthenticationNot required
LanguagesPythonShellYAML
Target softwareStarletteFastAPI
Attack typesAuthentication BypassHTTP Request Smuggling
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a Python script (badhost_openapi_scanner.py) that is explicitly described as a 'Detection-only scanner' in its own docstring and README. It sends crafted requests to detect the vulnerability and reports findings, but does not contain any code to exploit the vulnerability for malicious purposes such as extracting data or gaining unauthorized access. The included lab applications are for local testing of the scanner, not for exploitation.

Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/README.md:3Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_openapi_scanner.py:6

Requirements

  • Target URL of a Starlette/FastAPI applicationBhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_openapi_scanner.py:1083-1084
  • OpenAPI specification file or URL, or manual protected pathsBhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_openapi_scanner.py:1107

Observed behavior

  • Sends a baseline unauthenticated request to a protected endpoint and verifies it is denied (401/403).Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_openapi_scanner.py:481
  • Sends a crafted request with a malformed Host header (e.g., 'host:port/health?x=') to attempt to bypass authentication.Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_openapi_scanner.py:374-379
  • Compares the baseline and test responses to classify the result as CONFIRMED, SUSPECT, BLOCKED, etc.Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_openapi_scanner.py:382-406
  • Outputs a text summary, JSON, or CSV report of vulnerable endpoints.Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_openapi_scanner.py:1231-1244
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Behavior
Sends crafted HTTP requests with malformed Host and X-Forwarded-Host headers to target URLsCore functionality of the CVE-2026-48710 scanner; documented in README and implemented in badhost_openapi_scanner.pyBhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_openapi_scanner.py:250-355Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/README.md:6-10
File Operation
Reads local OpenAPI JSON/YAML files and fetches OpenAPI specs from URLsUsed to generate probe requests for scanning; implemented in load_json_or_yaml_like functionBhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_openapi_scanner.py:575-600
Output
Reports scan results as text summary, JSON, or CSV to stdout; progress to stderrStandard reporting for a security scanner; no exfiltration of sensitive dataBhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_openapi_scanner.py:1231-1244
Review boundaries

What the analysis did not establish

  • Evidence does not include the full repository snapshot; only selected text files from the PoC unit are provided.
  • The analysis is based solely on static code review; the scanner was not executed against a live target.
  • 4 unclassified binary files totaling 1741 bytes were present in the artifact but not analyzed; their metadata-only inventory does not indicate executable payloads.
  • The review is limited to the supplied text evidence; the actual runtime behavior of the scanner was not executed or observed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

2026/CVE-2026-48710/Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_vuln_lab/docker-compose.yml

Created Vuln labCVE-2026-48710Compose · builds

1 Compose manifest · 1 Dockerfile · 2 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that starts two FastAPI/Starlette services: a vulnerable app on port 8000 and a fixed comparison app on port 8001, both built from the same Dockerfile and using intentionally vulnerable package versions for CVE-2026-48710 testing.

2026/CVE-2026-48710/Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_vuln_lab/docker-compose.yml:1-142026/CVE-2026-48710/Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_vuln_lab/Dockerfile:1-132026/CVE-2026-48710/Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_vuln_lab/README.md:1-10

Lab assessment

Vulnerability lab

The README explicitly states it is an intentionally vulnerable local lab for testing CVE-2026-48710, the vulnerable app contains a deliberately bad middleware pattern, and the fixed app provides a comparison. The Docker Compose file starts both services for side-by-side testing.

2026/CVE-2026-48710/Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_vuln_lab/README.md:1-102026/CVE-2026-48710/Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_vuln_lab/app_vulnerable.py:1-102026/CVE-2026-48710/Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_vuln_lab/docker-compose.yml:1-14
Lab shapeCompose · builds
Services2
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

vuln service

vulnerable targetFastAPI/Starlette web application

Runs app_vulnerable.py on port 8000. Contains an intentionally vulnerable middleware that uses request.url.path for auth decisions, allowing a malformed Host header to bypass path-based access controls.

2026/CVE-2026-48710/Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_vuln_lab/docker-compose.yml:2-72026/CVE-2026-48710/Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_vuln_lab/app_vulnerable.py:1-102026/CVE-2026-48710/Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_vuln_lab/app_vulnerable.py:30-50

fixed service

fixed comparisonFastAPI/Starlette web application

Runs app_fixed.py on port 8001. Uses request.scope['path'] for auth decisions, demonstrating the correct fix. Uses the same vulnerable Starlette version to isolate the code-level fix.

2026/CVE-2026-48710/Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_vuln_lab/docker-compose.yml:9-142026/CVE-2026-48710/Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_vuln_lab/app_fixed.py:1-102026/CVE-2026-48710/Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_vuln_lab/app_fixed.py:30-50

Dockerfile

container image builder

Builds a Python 3.11-slim image, installs dependencies from requirements.txt, copies both app_vulnerable.py and app_fixed.py, and exposes ports 8000 and 8001. Default CMD starts the vulnerable app.

2026/CVE-2026-48710/Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_vuln_lab/Dockerfile:1-13

requirements.txt

dependency manifest

Pins intentionally vulnerable versions: fastapi==0.115.12, starlette==0.46.2, uvicorn[standard]==0.34.2, pydantic>=2.7,<3.

2026/CVE-2026-48710/Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_vuln_lab/requirements.txt:1-6

manual_test.sh

test script

Bash script that sends curl requests to both services to demonstrate the vulnerability bypass on the vulnerable app and the correct blocking on the fixed app.

2026/CVE-2026-48710/Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_vuln_lab/manual_test.sh:1-20

run_without_docker.md

alternative run instructions

Markdown file with instructions to run the vulnerable and fixed services directly in a virtualenv without Docker.

2026/CVE-2026-48710/Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_vuln_lab/run_without_docker.md:1-15
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-48710

Supported by supplied evidence

The lab is explicitly built for CVE-2026-48710 testing. The vulnerable app demonstrates the described Host header manipulation leading to auth bypass via request.url.path, and the README references the CVE and expected behavior.

2026/CVE-2026-48710/Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_vuln_lab/README.md:1-102026/CVE-2026-48710/Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_vuln_lab/app_vulnerable.py:1-102026/CVE-2026-48710/Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_vuln_lab/app_vulnerable.py:30-50
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose installed to build and run the services.2026/CVE-2026-48710/Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_vuln_lab/README.md:11-13
  • Network access to localhost ports 8000 and 8001 for testing.2026/CVE-2026-48710/Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_vuln_lab/docker-compose.yml:6-72026/CVE-2026-48710/Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_vuln_lab/docker-compose.yml:13-14

Evidence-described exercise path

  1. Start the lab with 'docker compose up --build'.2026/CVE-2026-48710/Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_vuln_lab/README.md:11-13
  2. Send a normal request to the vulnerable app's /admin endpoint to observe a 403 Forbidden response.2026/CVE-2026-48710/Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_vuln_lab/README.md:19-202026/CVE-2026-48710/Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_vuln_lab/manual_test.sh:7-8
  3. Send a request with a malformed Host header (e.g., 'Host: 127.0.0.1:8000/health?x=') to the vulnerable app's /admin endpoint to observe a 200 OK bypass.2026/CVE-2026-48710/Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_vuln_lab/README.md:21-222026/CVE-2026-48710/Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_vuln_lab/manual_test.sh:10-11
  4. Repeat the same requests against the fixed app on port 8001 to confirm the bypass is blocked (403).2026/CVE-2026-48710/Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_vuln_lab/README.md:23-242026/CVE-2026-48710/Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_vuln_lab/manual_test.sh:13-17
  5. Optionally run an OpenAPI-driven scanner against the vulnerable and fixed apps as described in the README.2026/CVE-2026-48710/Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_vuln_lab/README.md:37-62
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is confined to the lab's own containers. The services listen on localhost-mapped ports, do not mount host filesystems, do not run in privileged mode, and do not connect to external systems. The exploit demonstration targets only the intentionally vulnerable app within the lab.

2026/CVE-2026-48710/Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_vuln_lab/docker-compose.yml:1-142026/CVE-2026-48710/Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_vuln_lab/Dockerfile:1-132026/CVE-2026-48710/Bhanunamikaze-BadHost-CVE-2026-48710-Exploit-588f307/badhost_vuln_lab/app_vulnerable.py:1-10
Review boundaries

What the analysis did not establish

  • The packet does not include the referenced badhost_openapi_scanner.py script, so its behavior cannot be assessed.
  • The exact nature of CVE-2026-48710 in Starlette is not detailed beyond the lab's demonstration; the lab pins starlette==0.46.2 as vulnerable but does not provide upstream CVE details.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1