CVE-2026-48710: Starlette "BadHost" Request Smuggling Vulnerability

A flaw in Starlette’s HTTP request handling allows remote attackers to inject arbitrary path segments directly into the host portion of an incoming request. Tracked as CVE-2026-48710, this Kludex Starlette HTTP Request/Response Smuggling Vulnerability—publicly dubbed “BadHost”—enables unauthenticated attackers to manipulate how the framework reconstructs request URLs. Because Python web frameworks like FastAPI rely heavily on Starlette for request routing and URL building, this vulnerability creates a direct path to authentication bypass in applications that evaluate access control based on internal path matching.

How BadHost Manipulates URL Reconstruction

The vulnerability stems from improper validation of incoming HTTP Host headers (CWE-444 / CWE-1289). When an application processes a request, Starlette parses the Host header to reconstruct absolute URLs used across the ASGI stack. By passing a crafted Host header containing path elements (such as Host: target.com/injected_path), an attacker forces Starlette to prepend /injected_path to the application’s internal request evaluation.

This discrepancy between what an upstream reverse proxy sees and what Starlette’s internal request object builds introduces dangerous logic flaws:

• Proxy Perspective: The front-end proxy sees a request for /public/data and permits it through access controls.
• Starlette Perspective: Starlette reconstructs the URL as https://target.com/injected_path/public/data or evaluates internal paths such that route handlers route the execution to an administrative endpoint.

From an operational standpoint, the attack requires no credentials and zero user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). With an EPSS score of 2.1% (placing it in the 80.4th percentile of all scored vulnerabilities), automated scanning against public Python microservices for this specific host-header behavior represents an active risk.

Framework Exposure and Exploit Chaining

Because Starlette is the standard underlying HTTP layer for FastAPI and a broad ecosystem of Python microservices, exposure is widespread. Any environment running encode/starlette versions between 0.8.3 and 1.0.0 that relies on request path inspection for auth policy enforcement or URL generation is exposed.

Furthermore, this flaw can be chained with CVE-2026-42271 to amplify impact depending on how downstream application logic handles response construction. Beyond direct authentication bypass, manipulating Starlette’s reconstructed URL can cause applications to generate tainted password reset links, broken OAuth redirect URIs, or poisoned web cache entries when operating behind caching proxies.

Remediating CVE-2026-48710

Securing vulnerable environments requires updating the dependency in your application environment and hardening edge proxy rules:

• Apply the Software Patch: Upgrade starlette to version 1.0.1 or higher (commit 764dab0dcfb9033d75442d7a359645c9f94648c6). If your project uses FastAPI or another dependent framework, explicitly update starlette in your dependency lockfiles (requirements.txt, poetry.lock, or Pipfile.lock).
• Sanitize Host Headers at the Edge: Configure upstream reverse proxies (such as Nginx, Traefik, HAProxy, or AWS ALB) to drop or reject requests containing slashes, backslashes, or control characters in the Host header with a 400 Bad Request before traffic reaches your ASGI application servers (e.g., Uvicorn or Hypercorn).