Starlette BadHost: one Host header bypasses your auth

If you run anything Python and web-facing, you almost certainly run Starlette — and the Starlette BadHost flaw means a single malformed Host header can walk past your authentication middleware. CVE-2026-48710 affects every release below 1.0.1. CISA added it to the Known Exploited Vulnerabilities catalog on September 2 with a federal remediation deadline of September 16. You are almost certainly downstream of this whether or not you have heard of Starlette.

What actually happened

Starlette rebuilds the request URL by string-concatenating the raw Host header with the path:

f"{scheme}://{host_header}{path}"

No validation against RFC 3986. So a Host value containing /, ? or # moves the boundary between host, path and query. Send this:

GET /protected HTTP/1.1
Host: example.com/health?x=

The ASGI server routes on the real wire path and hands you /protected. But request.url.path now reads /health. Middleware that gates on request.url.path sees a public health check. The router serves the protected endpoint. That is the whole bug.

The vulnerability was found by X41 D-Sec during an OSTIF-sponsored audit, and independently by Nicolas Lamoureux and Larry Yuan. CISA files it as request smuggling. The blast radius is the part that matters: the disclosure site names vLLM, LiteLLM, Ray Serve, BentoML, Google ADK-Python and MCP server implementations among affected downstreams, against 400,000-plus GitHub dependents of Starlette itself.

Scanner scores will mislead you here. Snyk rates it 6.9 under CVSS 4.0 because the framework itself only leaks a path. Your severity is set by what your middleware does with that path, not by the number in the feed.

Why a transitive dependency matters for your business

Nobody installs Starlette. You install FastAPI, or an AI gateway, or an MCP server, and Starlette arrives underneath it. That is exactly the class of dependency that never appears on a patch list, because nothing in your stack has its name on the box.

Three checks, in order. Run pip index versions starlette or read your lockfile and get to 1.0.1 or later — the fix ignores Host headers with invalid characters instead of building URLs from them. Then grep your middleware for request.url.path used in an authorization decision and swap it for scope["path"], which is the ASGI value and cannot be poisoned this way. FastAPI's Depends() and Security() are fine — they dispatch on route matching, not the reconstructed URL.

Then look upstream at your proxy. An RFC-compliant nginx, Caddy, Traefik or HAProxy in front normalizes or rejects a malformed Host before Python ever sees it. If your app is on a serverless runtime or talks to the internet directly, you do not have that layer, and the upgrade is the only control you have. This is the same shape as the LiteLLM MCP bypass — AI infrastructure inheriting a web-framework assumption nobody re-checked.

Sources: OSTIF BadHost disclosure, badhost.org advisory, CISA KEV alert, September 2, Snyk vulnerability record.