Is CVE-2026-48061 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48061 being exploited in the wild.

How severe is CVE-2026-48061?

Medium severity, with a CVSS score of 5.9, published 3 August 2026.

Which products and versions are affected?

litestar (PyPI) < 2.22.0, ECOSYSTEM:introduced=0,fixed=2.22.0.

Is there a fix for CVE-2026-48061?

Yes. litestar (PyPI): upgrade to 2.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48061 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-48061?

Check whether you run litestar (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48061: Litestar AllowedHostsMiddleware host validation bypass

Q: Which products and versions are affected?

litestar (PyPI) < 2.22.0, ECOSYSTEM:introduced=0,fixed=2.22.0.

Q: Is there a fix for CVE-2026-48061?

Yes. litestar (PyPI): upgrade to 2.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-48061 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-48061?

Check whether you run litestar (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48061 · Severity: medium · CVSS 5.9 · Published 2026-08-03

Litestar is a Python web framework used for building APIs and applications. A security flaw in its host validation middleware allows attackers to bypass domain restrictions by using a specific web header. This could allow an attacker to trick the system into sending password reset links to a malicious site or corrupting the application's cache, potentially leading to account takeovers or service disruptions.

Technologies: litestar (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-48061 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48061 being exploited in the wild.
How severe is CVE-2026-48061?: Medium severity, with a CVSS score of 5.9, published 3 August 2026.
Which products and versions are affected?: litestar (PyPI) < 2.22.0, ECOSYSTEM:introduced=0,fixed=2.22.0.
Is there a fix for CVE-2026-48061?: Yes. litestar (PyPI): upgrade to 2.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48061 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-48061?: Check whether you run litestar (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

litestar (PyPI): upgrade to 2.22.0 or later
```
pip install "litestar>=2.22.0"
```

Technical details

The AllowedHostsMiddleware in Litestar incorrectly trusts the client-controlled X-Forwarded-Host header as a fallback when the standard Host header is missing. An attacker can exploit this by sending a request without a Host header and setting X-Forwarded-Host to a whitelisted domain, bypassing the regex-based host validation. This vulnerability is particularly effective in environments without a reverse proxy that strips untrusted forwarding headers. Successful exploitation enables host header injection attacks, including password reset poisoning, cache poisoning, and routing manipulation. The issue is fixed in version 2.22.0.

Affected products

litestar-org litestar < 2.22.0

Identifiers

CVE-2026-48061
GHSA-3qmc-cj7q-62hv
PYSEC-2026-2603

Timeline

2026-05-20: disclosed: Vulnerability reported to maintainers
2026-06-10: advisory: GitHub Advisory published
2026-06-10: patched: Fix released in version 2.22.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.