CVE-2026-48817: Starlette unsafe reflection in HTTPEndpoint method dispatching

CVE-2026-48817 · Severity: medium · CVSS 5.3 · Published 2026-06-17

Starlette is a popular software toolkit used to build web applications and APIs, including those built with the FastAPI framework. A security flaw allows attackers to bypass intended access controls by sending specially crafted web requests that trigger internal functions not meant for public use. This could allow unauthorized actions to be performed on the server if the application uses certain internal helper methods.

Technologies: Kludex Starlette-Auth-Toolkit, starlette (PyPI). Vendors: Kludex, PyPI.

Quick answers

Is CVE-2026-48817 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48817 being exploited in the wild.
How severe is CVE-2026-48817?
Medium severity, with a CVSS score of 5.3, published 17 June 2026.
Which products and versions are affected?
Kludex Starlette-Auth-Toolkit <= 1.0.1; starlette (PyPI) ECOSYSTEM:introduced=0,fixed=1.1.0.
Is there a fix for CVE-2026-48817?
Yes. starlette (PyPI): upgrade to 1.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48817 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-48817?
Check whether you run Kludex Starlette-Auth-Toolkit or starlette (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • starlette (PyPI): upgrade to 1.1.0 or later
    pip install "starlette>=1.1.0"

Technical details

A vulnerability in Starlette's HTTPEndpoint class (and derived frameworks like FastAPI) allows for unsafe reflection via the HTTP method name. When a request is dispatched, the framework converts the HTTP method to lowercase and uses `getattr` to invoke the corresponding method on the class without validating it against a whitelist of standard HTTP verbs. If an HTTPEndpoint is registered via a Route without an explicit `methods` argument, an attacker can send a non-standard HTTP method (e.g., an internal helper name) to execute arbitrary class methods that accept a request argument. This bypasses the authorization logic typically residing in standard handlers like `get()` or `post()`. The issue is fixed in version 1.1.0 by restricting dispatch to standard HTTP verbs.

Affected products

  • Kludex Starlette <= 1.0.1

Identifiers

  • CVE-2026-48817
  • GHSA-x746-7m8f-x49c
  • PYSEC-2026-2280

Timeline

  • 2026-05-23: patched: Version 1.1.0 released
  • 2026-05-23: advisory: GitHub Security Advisory GHSA-x746-7m8f-x49c published
  • 2026-06-17: disclosed: CVE-2026-48817 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.