Security brief

Starlette Host-header flaw could undermine path-based security checks

REVIEW

CVE-2026-48710 matters where application authorization relies on a reconstructed URL path that differs from actual routing.

Published 29 Oct 2026 · Material update 21 May 2026 — last time the underlying evidence changed · Evidence: high

What happened

Starlette’s advisory describes missing Host-header validation when reconstructing a request URL. A malformed header could make the derived URL path differ from the raw path used for routing.

Middleware or endpoints relying on the reconstructed path for security checks could therefore make the wrong authorization decision. The dependency’s popularity does not establish that every FastAPI application or AI agent exposes the same vulnerable security check.

The advisory lists Starlette through 1.0.0 as affected and 1.0.1 as fixed. Update affected dependencies, review path-based authorization and ensure upstream request validation does not leave a directly reachable, unprotected application listener.

Read the original source.

Next step

Update Starlette and review routing and authorization assumptions.

What we know

Fixed version
1.0.1.

What remains unknown

Open question
The sources reviewed do not establish whether your deployment was exploited.

Source references

Technical details

CVE
CVE-2026-48710