CVE-2026-48710 Scanner
CVE-2026-48710 Scanner - Unauthorized Admin Access vulnerability in Starlette
Used 2.9k times · 5.9k assets checked · domain, subdomain, ipv4
🔴
CISA Known Exploited Vulnerability
This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.
CVE
CVE-2026-48710
6.5
CVSSmedium
Exploitable remotely over the internet · no authentication required.
Description
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
starlettered hat ai inference server 3.3red hat ansible automation platform 2.6red hat ansible automation platform 2.7red hat migration toolkit for applications 8.2red hat openshift ai 3.3
Updated Sep 18, 2026View on NVD →
S4E scanner
CVE history: starlette
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →