Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks
Title source: cnaExploitation Summary
EIP tracks 4 public exploits for CVE-2026-48710. PoCs published by eris-ths, SecureWithUmer, Bhanunamikaze. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a set of scripts designed to scan for supply chain vulnerabilities, including compromised packages, IOCs (Indicators of Compromise), and lockfile integrity checks. It does not include exploit code but provides detection mechanisms for known malicious packages and artifacts.
Description
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.
Exploits (4)
This repository contains a set of scripts designed to scan for supply chain vulnerabilities, including compromised packages, IOCs (Indicators of Compromise), and lockfile integrity checks. It does not include exploit code but provides detection mechanisms for known malicious packages and artifacts.
This repository provides a functional proof-of-concept for CVE-2026-48710, demonstrating an authentication bypass vulnerability in Starlette/FastAPI applications due to improper handling of the Host header. The PoC includes both vulnerable and fixed versions of a FastAPI app, along with a scanner to detect the issue.
This repository contains a functional exploit PoC for CVE-2026-48710, demonstrating an authentication bypass vulnerability in Starlette/FastAPI applications. The exploit leverages malformed Host headers to manipulate request.url.path, bypassing middleware authentication checks.
This repository contains a functional exploit PoC for CVE-2026-48710, demonstrating a Host header URL confusion vulnerability in Starlette. The exploit manipulates the Host header to bypass authentication checks by causing a discrepancy between the reconstructed URL path and the actual routed path.
Nuclei Templates (1)
http.html:"starlette"
body="starlette"
References (24)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N