CVE-2026-48710: Starlette HTTP Request/Response Smuggling Vulnerability

Overview

CVE-2026-48710 affects Kludex Starlette, a lightweight ASGI framework, specifically versions prior to 1.0.1. The vulnerability stems from insufficient validation of the HTTP Host request header, allowing attackers to inject paths into the host part. This manipulation causes request.url.path to differ from the raw scope path, enabling authentication bypass in middleware or endpoints that rely on request.url for security decisions. This vulnerability can be chained with others, such as CVE-2026-42271.

Technical Analysis

Starlette versions before 1.0.1 do not adequately validate the HTTP Host request header before using it to reconstruct request.url. The routing algorithm, however, relies on the raw HTTP path (scope path). An attacker can craft a malformed Host header to prepend paths or inject other characters, causing request.url.path to diverge from the actual requested path.

Vulnerability Type: HTTP Request/Response Smuggling (CWE-444), Improper Input Validation (CWE-1289).
Affected Versions: encode starlette versions >= 0.8.3 and < 1.0.1. Various Red Hat products including ai_inference_server, ansible_automation_platform, migration_toolkit_for_applications, openshift_ai, openshift_lightspeed, and satellite are also affected.
Attack Vector: Network-based, unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N).
Impact: Authentication bypass, potentially leading to unauthorized access to resources. Can be chained with other vulnerabilities for broader impact, including remote code execution or cryptomining as observed in community intelligence.
Prerequisites: The application must be using an affected version of Starlette, and security-sensitive middleware or endpoints must rely on request.url for access control decisions.
Resolution: Starlette version 1.0.1 and later validate the Host header against RFC 9112 §3.2 / RFC 3986 §3.2.2 and fall back to scope["server"] for malformed values.

Detection

Defenders can identify potential exploitation attempts by monitoring web server and application logs for anomalies related to the Host header.

Web Server Logs: Monitor Host header fields (e.g., cs-host, Host) for the presence of path separators (/, \) or their URL-encoded equivalents (%2f, %2F, %5c, %5C). These characters are invalid within the hostname part of a standard HTTP Host header.
Application Logs: Look for unexpected authentication bypasses, unauthorized access to restricted resources, or unusual requests to internal paths that do not align with expected user behavior, especially when correlated with suspicious Host headers.
WAF/API Gateway Logs: Review logs for requests flagged due to malformed Host headers or unusual URL structures that might indicate an attempt to exploit this vulnerability.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Starlette CVE-2026-48710 Malformed Host Header Path Separator

title: Starlette CVE-2026-48710 Malformed Host Header Path Separator
id: 757d59b2-3e2a-4f5b-9c7d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2026-48710 by injecting path separators into the HTTP Host header, which can lead to request smuggling and authentication bypass in Starlette applications.
logsource:
  category: webserver
detection:
  selection:
    cs-host|contains:
      - '/'
      - '\'
  condition: selection
level: high

Starlette CVE-2026-48710 Malformed Host Header URL Encoded Path

title: Starlette CVE-2026-48710 Malformed Host Header URL Encoded Path
id: 8f9e0a1b-2c3d-4e5f-6a7b-8c9d0e1f2a3b
status: experimental
description: Detects attempts to exploit CVE-2026-48710 using URL-encoded path separators in the HTTP Host header, indicative of request smuggling or authentication bypass attempts against Starlette applications.
logsource:
  category: webserver
detection:
  selection:
    cs-host|contains:
      - '%2f'
      - '%2F'
      - '%5c'
      - '%5C'
  condition: selection
level: high

Mitigations

Prioritize patching and configuration changes to address this vulnerability.

Upgrade Starlette: Immediately upgrade Kludex Starlette to version 1.0.1 or greater. This version includes robust validation for the Host header.
Apply Vendor Patches: For affected Red Hat products, apply the latest security updates and patches provided by Red Hat.
Implement WAF/API Gateway Rules: Configure Web Application Firewalls (WAFs) or API gateways to strictly validate the Host header, blocking requests where the Host header contains path separators or other non-standard characters.
Review Application Logic: Ensure that security-sensitive middleware and application endpoints rely on the raw scope path for access control and routing decisions, rather than the potentially manipulated request.url.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-48710
https://badhost.org
https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6
https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr
https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette
https://www.secwest.net/starlette
https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette
https://www.wiz.io/blog/ai-infrastructure-honeypot
https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml
https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/
https://nvd.nist.gov/vuln/detail/CVE-2026-42271
https://horizon3.ai/attack-research/vulnerabilities/cve-2026-42271-chained-with-cve-2026-48710/
https://ltna.com.au/cyber

Indicators of Compromise

Type	Value	Description
SHA256	`3af9f25a4d45bb4f1ec5627cdbc6703cf3b4be75a892162d299d80ddfb266f42`	LiteLLM — XMRig cryptominer binary (variant) (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
SHA256	`3d24ac736635e0fa0c5c459c9e18ca09d1ec9a1751a4503130934395609bd7e0`	LiteLLM — installer / bridge script (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
SHA256	`49fdcf32bfe837899a84e8938f0d07ae96ddd218a280a09eb60df8d64597bd8f`	LiteLLM — XMRig cryptominer binary (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
SHA256	`f64b88e9318bdf23f2dd119a0ce1dd1bdb3c8cd2e0e1e23ba3ef2e19072b79cc`	LiteLLM #2 — unknown ELF binary (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
IP Address	`135.125.10.56`	RAGFlow exploitation C2 — LLM API key exfiltration endpoint (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
IP Address	`172.232.38.92`	Kestra reverse shell C2 (Linode VPS) (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
IP Address	`194.213.18.133`	Attacker-controlled mail MX / mail infrastructure (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
IP Address	`45.150.109.151`	Scanning/recon infrastructure (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
IP Address	`47.86.197.116`	c3pool mining endpoint (Kestra) (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain	`45.150.109.151.sslip.io`	DNS rebinding used in LiteLLM attacks (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain	`auto.c3pool.org`	XMRig Monero mining pool (Kestra) (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain	`gobygo.net`	C2 beacon infrastructure — subdomain-encoded LiteLLM beacons (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain	`oast.fun`	Out-of-band callback domain (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain	`oast.me`	Out-of-band callback domain (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain	`oast.pro`	Out-of-band callback domain (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)
Domain	`yosemite.jp`	C2/exfiltration endpoint — LiteLLM credential harvesting (via https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/)

MITRE ATT&CK

T1190 — Exploit Public-Facing Application
T1078.004 — Cloud Accounts
T1071.004 — DNS
T1036.005 — Match Legitimate Resource Name or Location
T1082 — System Information Discovery
T1071 — Application Layer Protocol
T1036 — Masquerading
T1552 — Unsecured Credentials
T1055 — Process Injection
T1552.004 — Private Keys
T1059 — Command and Scripting Interpreter
T1083 — File and Directory Discovery
T1552.001 — Credentials In Files
T1059.004 — Unix Shell
T1078 — Valid Accounts
T1027 — Obfuscated Files or Information
T1059.006 — Python
T1496 — Resource Hijacking
T1518 — Software Discovery
T1105 — Ingress Tool Transfer

  🤖 AI Attribution

  Generated by gemini-2.5-flash ·

  2,721 input / 2,018 output tokens ·

  Reviewed and approved by a human analyst before publication