Starlette Path-Prepending Flaw Enables HTTP Request/Response Smuggling, Added to CISA KEV

What Happened

CISA added CVE-2026-48710, a vulnerability in the Kludex Starlette ASGI framework, to its Known Exploited Vulnerabilities (KEV) catalog on 2026-09-02, indicating active exploitation in the wild. Per the GitHub Security Advisory, the flaw allows an attacker to inject paths into the host portion of a request, effectively prepending to the actual request path. This enables HTTP request/response smuggling behavior. The advisory notes the issue can potentially be chained with CVE-2026-42271, though details on that combination are not elaborated in the source.

Why It Matters

Starlette underpins a large portion of the Python async web ecosystem, including FastAPI. Path manipulation via the host header is particularly dangerous where authentication or access-control decisions are derived from the reconstructed URL path — the advisory explicitly calls out authentication bypass as a possible consequence. Any application, gateway, or reverse-proxy chain that reconstructs URLs from Starlette's parsed request objects for security decisions is potentially affected. CISA KEV inclusion means this isn't theoretical — exploitation has been observed.

What Defenders Should Watch For

• Inventory internet-facing services built on Starlette or FastAPI and confirm patch status against the fixed release referenced in the advisory.
• Review any custom logic that trusts a reconstructed request path or host header for auth, routing, or access-control decisions — this is the exact primitive the smuggling bypass targets.
• Hunt for anomalous or malformed Host headers, unexpected path segments embedded in host values, or requests that produce mismatched routing/auth outcomes between edge proxies and the Starlette application.
• Check reverse-proxy/load-balancer logs for discrepancies between the path seen at the edge and the path the application acted on — a classic smuggling tell.
• Where patching isn't immediately possible, consider strict host-header validation at the proxy layer as a stopgap.

Developing Intel

This is a same-day CISA KEV addition and details are still emerging, including the nature of chaining with CVE-2026-42271. We will monitor for updates. See the original advisory: GHSA-86qp-5c8j-p5mr.