CVE-2026-48710

Think of Starlette as the “traffic controller” for web requests in Python apps. This issue lets an attacker send a fake “address label” (the Host header) so Starlette builds the request URL in a misleading way.
If your app’s security rules look at that built URL path, the attacker can slip around those rules—like walking past a door guard by making them read the wrong sign.

This matters if you run or deploy Starlette-based Python web applications, or products that bundle Starlette—especially when they are internet-facing and use path-based checks based on request.url. The flaw is reachable in default configuration and does not require an attacker to be logged in.
Reachability gate: it’s a risk when the vulnerable code path is accessible over the network to an attacker (especially from the public internet) and the app uses request.url-based security restrictions (rather than the raw request path).

This is RED because it is confirmed in CISA KEV and listed with a specific CISA remediation due date (2026-09-16). Attackers can exploit it without authentication by sending a crafted Host header to poison how the app reconstructs request.url.path, letting them bypass path-based security checks.