CVE-2026-48710 (BadHost): How a Malformed Host Header Bypasses Starlette Path Authorization

CVE-2026-48710, also known as BadHost, is an authentication bypass vulnerability in the Starlette ASGI framework. This flaw arises from an inconsistent interpretation of HTTP requests (CWE-444), allowing attackers to manipulate the Host header in malicious ways. The vulnerability was first disclosed on September 2, 2026, and quickly gained attention due to active exploitation and CVE listing by CISA.

The problem stems from Starlette's method of reconstructing the request.url from the ASGI scope dictionary, which doesn't properly validate the Host header against RFC 9112 or RFC 3986. When the Host header includes URI delimiters such as /, ?, #, @, backslash, or spaces, the reconstructed URL can misinterpret the path boundary. This results in a discrepancy between the router's path dispatching mechanism and middleware that reads request.url.path, potentially allowing unauthorized access to protected endpoints.

To be exploitable, the application must rely on request.url or request.url.path for security decisions, typically through path-prefix allowlists or public-path bypass lists. The vulnerability doesn't work with reverse proxies, CDNs, or API gateways that reject or normalize malformed Host headers. Protected endpoints by FastAPI Depends() or Security() dependencies, or by business-layer permission checks, are not affected.

This vulnerability carries a medium CVSS v3.1 score of 6.5 but was rated higher at 7.0 by X41 D-Sec, arguing that the score underestimates the impact in AI tooling deployments. Successful exploitation grants attackers unauthenticated access to intended-protected endpoints. Initial exploitation can transition from a 403 Forbidden response to a 200 OK response, highlighting the severity depending on the endpoint's functionality.

The LiteLLM case demonstrates a chain of vulnerabilities, leading to potential remote code execution on the LiteLLM host, exposing sensitive information and infrastructure.

Affected products include Starlette versions from 0.8.3 to 1.0.0, and downstream frameworks such as FastAPI, vLLM, Text Generation Inference, LiteLLM, and others. An upgrade to Starlette 1.0.1 or later directly resolves the issue, while inspecting and updating the dependency tree is crucial. Business logic should bind checks to endpoints through Starlette requires() or FastAPI Depends() and Security() instead of relying on reconstructed URLs.

Additional measures include auditing codebases for request.url.path usage in access decisions, filtering malformed Host headers at the edge, and employing edge security measures like reverse proxies or WAFs.