Executive brief
Starlette is a popular software toolkit used to build web applications and APIs, including those built with the FastAPI framework. A security flaw allows attackers to bypass intended access controls by sending specially crafted web requests that trigger internal functions not meant for public use. This could allow unauthorized actions to be performed on the server if the application uses certain internal helper methods.
Technical details
A vulnerability in Starlette's HTTPEndpoint class (and derived frameworks like FastAPI) allows for unsafe reflection via the HTTP method name. When a request is dispatched, the framework converts the HTTP method to lowercase and uses `getattr` to invoke the corresponding method on the class without validating it against a whitelist of standard HTTP verbs. If an HTTPEndpoint is registered via a Route without an explicit `methods` argument, an attacker can send a non-standard HTTP method (e.g., an internal helper name) to execute arbitrary class methods that accept a request argument. This bypasses the authorization logic typically residing in standard handlers like `get()` or `post()`. The issue is fixed in version 1.1.0 by restricting dispatch to standard HTTP verbs.
Affected products
- Kludex Starlette <= 1.0.1
Timeline
- 2026-05-23: patched: Version 1.1.0 released
- 2026-05-23: advisory: GitHub Security Advisory GHSA-x746-7m8f-x49c published
- 2026-06-17: disclosed: CVE-2026-48817 published to NVD