Severity Daily

IT and AI security incidents, checked against the primary source

Tag: Starlette

  • Four deadlines expire Saturday, which is why the day’s four fresh 9.8s are not the lead

    Four deadlines expire Saturday, which is why the day’s four fresh 9.8s are not the lead

    Four items published today carry a federal remediation deadline of Saturday, September 5. That is two days out, and it is the day’s lead. It outranks the four fresh 9.8s that landed alongside it, because a 9.8 with no confirmed exploitation and no clock attached is a patch you schedule, and a Saturday deadline is a patch somebody has to be at a keyboard for. Two of those 9.8s do not have a release number to install anyway.

    The thread is real, and it is CISA’s. Six of today’s ten stories trace back to one batch of Known Exploited Vulnerabilities additions made on September 2 — four due September 5, two due September 16. Running underneath it is the same problem in three of the four Saturday items: the authoritative record does not cleanly say what to install.

    Deal with SonicWall’s SMA1000 pair first. It is an internet-facing access appliance, it is the third zero-day pair on that product, and the CVE records SonicWall assigned itself list affected builds without naming a fixed one — two days before the deadline. Then JFrog Artifactory, where CISA’s listing is the first government confirmation that the unauthenticated administrative bypass is being exploited, and where the medium-severity Artifactory CVE listed six days earlier is now due five days later than the critical one. Then Sangoma’s Switchvox, where the release notes mark the fix for both cloud and on-premises but the only CPE on the record covers on-premises, so an agency running the cloud edition cannot tell from the record whether it is in scope. Then Kestra, the one of the four whose difficulty is a label rather than a version: CISA files it as OS command injection, and what an attacker actually reaches is a filter asking whether a request path ends with the word configs.

    The two September 16 items are lower on the clock and higher on reach. Starlette’s BadHost is a 6.5 by three independent scorers, which is the number most likely to send a KEV entry to the bottom of a patch queue — and Starlette is what FastAPI is built on, so the inventory question is not “do we run Starlette” but “what did we build on FastAPI.” LiteLLM is the narrower one, and the sharper bug: the MCP endpoint answered a failed key check by substituting an empty authorization object and letting the request through.

    After the clocked items, the 9.8s. Cisco’s Nexus 9000 Silicon One root RCE names ten switch SKUs and points its Fixed Software section at an interactive tool instead of a release number; the record has no CPE data at all. Cisco’s IOS XR hardening release, published the same afternoon, packages an internal audit into seven CVEs across every release, two of them 9.8, with one CVE ID standing for thirteen distinct weakness types. That is Cisco twice in one day, both times with a remediation story that is harder to read than the vulnerability. Delinea’s Secret Server takes a 9.8 at the FIDO2 registration step in a privileged access manager, and NVD deferred the record the following day, leaving it with no machine-matchable version data. And thirteen Craft CMS CVEs arrived from two CNAs, neither of them Craft, onto advisories that say “No known CVE” — with one advisory drawing two IDs and one record carrying a description for a different bug.

    What is still open. SonicWall has not named a fixed build for either SMA1000 CVE with the deadline on Saturday. JFrog has published no in-the-wild statement of its own; the government confirmed exploitation before the vendor did. Sangoma has not resolved the cloud-versus-on-premises scope on the record itself. Cisco’s first IOS XR fix that is not a software maintenance update has not shipped, and it revised the fixed-release list within six hours of publishing it. The Delinea record is deferred, so scanners matching on CPE will not flag an affected install.

  • Starlette’s BadHost is KEV-listed at CVSS 6.5, and CISA filed the FastAPI dependency under a bug class it is not

    Starlette’s BadHost is KEV-listed at CVSS 6.5, and CISA filed the FastAPI dependency under a bug class it is not

    Three independent scorers rate CVE-2026-48710 a 6.5 medium, CISA’s catalog calls it request smuggling, and the researchers who found it call it an authentication bypass — it is now on a federal clock either way.

    What happened

    CISA added CVE-2026-48710 to the Known Exploited Vulnerabilities catalog on September 2, 2026. NVD’s record carries the fields verbatim: cisaExploitAdd of 2026-09-02, cisaActionDue of 2026-09-16. That is the 14-day band, not the three-day one.

    The catalog names it “Kludex Starlette HTTP Request/Response Smuggling Vulnerability.” The flaw is in Starlette, the lightweight ASGI framework that FastAPI is built on. NVD’s description: “Prior to version 1.0.1, the HTTP Host request header was not validated before being used to reconstruct request.url. Because the routing algorithm relies on the raw HTTP path while request.url is rebuilt from the Host header, a malformed header could make request.url.path differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on request.url (rather than the raw scope path) could therefore be bypassed.”

    The researchers call it BadHost. X41 D-Sec found it in January 2026 during a source-code audit of vLLM that OSTIF managed and the Alpha-Omega Project sponsored; the downstream notification work was sponsored in part by Amazon Web Services. X41’s advisory X41-2026-002 gives the timeline: identified January 27, 2026; proof of concept built and vendor notified February 4; patch released May 21; advisory published May 22.

    The mechanism, in X41’s words, is that Starlette builds a URL as "{scheme}://{host_header}{path}" without rejecting characters the Host header is not allowed to contain. Send Host: example.com/abc?bar= against a request for /foo, and the reconstructed URL parses as path /abc with the real path swallowed into the query string. Routing still dispatches to /foo, because routing uses the raw scope path. Any middleware that made its decision from request.url.path made it about a different request than the one that ran.

    Affected versions are 0.8.3 through 1.0.0. Version 1.0.1 validates the Host header against the grammar of RFC 9112 §3.2 and RFC 3986 §3.2.2 and falls back to scope["server"] for malformed values.

    Why it matters

    Start with the score, because it is the part that will cause the most trouble. Three separate entries on the NVD record — GitHub’s advisory database as Secondary, [email protected] as Primary, and a third secondary source — all land on 6.5 medium, on the identical vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. Low confidentiality impact, low integrity impact, no availability impact, unchanged scope. X41, the only party that had built a working proof of concept, rated it High at 7.0.

    The scorers are not wrong about Starlette. A Host header parsing inconsistency, considered as a property of a framework, really does have low direct impact; the framework itself does not lose anything. The impact belongs entirely to whatever the application built on top of it decided to protect with that value. CVSS scores the component. Exploitation happens to the deployment. This CVE is a clean demonstration that those are different questions, and that a 6.5 is not a statement that nobody is being attacked through it.

    Any organization whose vulnerability program suppresses medium-severity findings in transitive Python dependencies has been correctly following its own policy and is now on a federal deadline anyway.

    Then there is the classification. CISA’s catalog title says HTTP request/response smuggling, which follows the record’s CWE-444. The record also carries CWE-1289, improper validation of unsafe equivalence in input, which is much closer to what happened. X41’s own advisory classifies it as CWE-436, interpretation conflict. Three classifications, three genuinely different mental models: a smuggling bug is about a proxy and an origin disagreeing on where a request ends; an interpretation conflict is about two parsers reading the same bytes differently; an equivalence bug is about a check treating unequal things as equal. The last two describe this. The first is the one that will appear in most dashboards.

    This matters for the same reason it mattered on the Kestra entry CISA added the same day: the catalog is increasingly an input to automated triage rather than a page a human reads. An engineer told to check for request smuggling looks at load balancers, reverse proxies, and CDN configuration. Nothing in that search finds a Python web framework three levels down a requirements file.

    Which raises the harder problem. Starlette is not a product. It is not in anyone’s asset inventory, it has no license entry, and almost nobody installed it deliberately — it arrives as a dependency of FastAPI, and FastAPI arrives as a dependency of whatever the team actually chose. The KEV entry identifies the vendor as “Kludex,” which is the GitHub username of the framework’s maintainer. That is CISA doing the only sensible thing available, and it is also a fair picture of where federal remediation deadlines now point: at a single-maintainer open-source library, named by handle.

    The blast radius is visible in the record’s own reference list. Red Hat alone has issued more than twenty separate RHSA errata for this one CVE, which is a reasonable proxy for how many distinct shipped products contain the library. OSTIF’s disclosure names the downstream projects the researchers checked: FastAPI, LiteLLM, vLLM, text generation inference projects, OpenAI shim proxies, MCP servers, and agent harnesses. Their summary is that it “hits very large and prominent projects.” They did not publish a count, and we are not going to invent one.

    That list is worth reading twice, because it is almost entirely AI-serving infrastructure — which is not a coincidence. The bug was found during an audit of vLLM. And it is not the only AI-stack entry in the September 2 batch: CISA added LiteLLM’s CVE-2026-59822 the same day, on the same September 16 deadline, and LiteLLM appears on the BadHost list of affected downstreams. Both records cite the same piece of research, Wiz’s AI infrastructure honeypot writeup. The pattern in this batch is not one framework. It is that the layer organizations stood up over the past two years to serve models has become a place attackers now look first, and that layer is Python web plumbing with a lot of hand-rolled path-based authorization in front of it.

    What to do

    Resolve Starlette’s version, not FastAPI’s. pip show starlette, or check the lockfile — anything from 0.8.3 through 1.0.0 is affected, and 1.0.1 or later is fixed. Pinning FastAPI without repinning the transitive dependency does nothing.

    If you cannot upgrade immediately, the code-level mitigation is to stop deriving authorization from the reconstructed URL. Middleware that reads request.url.path should read request.scope["path"] instead, which is the raw path the ASGI server received and the same value routing uses. A Host allowlist at the proxy, or Starlette’s own TrustedHostMiddleware, also cuts off the injection, and is the faster change in most deployments.

    Search your own code for the pattern rather than only checking versions. Any place that makes a security decision from request.url, str(request.url), or request.url.path — path prefix checks for admin routes, internal-only route guards, tenant scoping — is the vulnerable shape, and it stays a fragile shape after the upgrade.

    Federal agencies have until September 16, 2026. The required action includes CISA’s forensic triage clause and a discontinue-use provision where mitigations are unavailable, so the deliverable is not only a dependency bump. For AI gateways and model-serving endpoints specifically, check access logs for Host headers containing /, ?, or #; those characters are not legal in a Host header, so any request carrying them was malformed on purpose.

    Sourcing note

    KEV dates, the catalog vulnerability name, the required action text, the description, the CWE assignments, the three CVSS metric entries with their source identifiers, vulnStatus, and the reference list all come from NVD’s API record for CVE-2026-48710, which republishes CISA’s fields verbatim. The disclosure timeline, the 7.0 High rating, the CWE-436 classification, and the Host header example come from X41 D-Sec’s advisory X41-2026-002. The audit sponsorship and the list of affected downstream projects come from OSTIF’s own disclosure post.

    CISA’s alert page and KEV catalog feed both return HTTP 403 to automated requests, so the catalog was reached through NVD rather than directly. Note that NVD’s record for this CVE was still marked “Undergoing Analysis” with a lastModified of September 2, 2026 at 6:19 p.m. UTC when we retrieved it, roughly a day and a half after the addition.

    The Red Hat errata count is a count of URLs on NVD’s reference list for this CVE, not a Red Hat statement about product coverage. We did not independently verify exploitation; the exploitation determination is CISA’s, and CISA does not publish its evidence in the catalog. Unresolved: what exploitation CISA observed and against which downstream project, and whether the researchers’ 7.0 or the three concurring 6.5 scores better reflects the bug as deployed.