Starlette - Improper Access Control (CVE-2026-48710)

CVE-2026-48710 is an improper access control vulnerability in the Starlette ASGI framework, where the HTTP Host header was not properly validated before being used to reconstruct request URLs. This flaw could allow attackers to craft malicious Host headers, potentially bypassing security restrictions enforced by middleware or endpoints that rely on request.url for access control. As a result, unauthorized access to protected resources or endpoints may be possible until the issue is patched.

CrowdSec has been tracking this vulnerability and its exploits since 1st of July 2026.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2026-48710 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2026-48710. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Attackers exploit this vulnerability by sending HTTP requests with a specially crafted Host header (such as Host: a/?x=) to endpoints like /mcp-rest/test/connection, bypassing middleware or path-based security checks that rely on improper URL reconstruction.