Starlette (FastAPI): a bad Host header can slip past permission checks
Identifiers: CVE-2026-48710 · GHSA-86qp-5c8j-p5mr · CVSS 3.1 6.5 (scored by GitHub)
What it is
Starlette, the base of FastAPI, rebuilt the request URL from the Host header without checking it. A Host such as 'example.com/abc?x=' makes request.url show a different path than the one actually routed, so middleware or endpoints that decide access by looking at request.url can be bypassed. CISA lists it as exploited in the wild.
On CISA's Known Exploited Vulnerabilities list since September 2, 2026.
Who is affected
Versions inside these ranges are affected. The fixed versions are the ones to move to.
| Registry | Package | Affected | Move to |
|---|---|---|---|
| PyPI | starlette | <= 1.0.0 | 1.0.1 |
How to check
Run one of these in your project's folder; the first two download the CLI and check its SHA-256 first:
d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" depsdocker run --rm -v "$PWD:/src" -w /src alpine:3.20 sh -c 'apk add -q curl && d="$(mktemp -d)" && a="xsec-$(uname -m | sed s/arm64/aarch64/)-unknown-linux-musl.tar.gz" && curl -fsSL -o "$d/$a" "https://github.com/xtruct-col/xsec-action/releases/latest/download/$a" && curl -fsSL -o "$d/checksums.txt" "https://github.com/xtruct-col/xsec-action/releases/latest/download/checksums.txt" && (cd "$d" && grep " $a$" checksums.txt | sha256sum -c -) && tar -xzf "$d/$a" -C "$d" xsec && "$d/xsec" deps'xsec depsOr look up starlette in your lockfile and compare the version with the ranges above.
How to fix it
Upgrade starlette to 1.0.1 or later (and FastAPI to a release that allows it; starlette usually comes in through fastapi, so check the version actually installed). Meanwhile, have your proxy reject malformed Host headers, and check permissions on the routed path, not on request.url.
Sources
This list is curated by hand and kept short on purpose: it is not every known vulnerability, and a clean xsec deps does not mean no dependency has a flaw. Use your package manager's audit (npm audit, pip-audit, bundle audit) or Dependabot for the rest.