# CVE-2026-48817: Starlette unsafe reflection in HTTPEndpoint method dispatching

Source: https://junglewise.ai/threats/cve-2026-48817-starlette-unsafe-reflection-in-httpendpoint-method-dispatching  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-06-20  
License: CC BY 4.0 with a link back

CVE-2026-48817 · Severity: medium · CVSS 5.3 · Published 2026-06-17

Starlette is a popular software toolkit used to build web applications and APIs, including those built with the FastAPI framework. A security flaw allows attackers to bypass intended access controls by sending specially crafted web requests that trigger internal functions not meant for public use. This could allow unauthorized actions to be performed on the server if the application uses certain internal helper methods.

Technologies: [Kludex Starlette-Auth-Toolkit](https://junglewise.ai/threats/technologies/starlette-auth-toolkit), [starlette (PyPI)](https://junglewise.ai/threats/technologies/pypi-starlette). Vendors: [Kludex](https://junglewise.ai/threats/vendors/kludex), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-48817 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48817 being exploited in the wild.

**How severe is CVE-2026-48817?** Medium severity, with a CVSS score of 5.3, published 17 June 2026.

**Which products and versions are affected?** Kludex Starlette-Auth-Toolkit <= 1.0.1; starlette (PyPI) ECOSYSTEM:introduced=0,fixed=1.1.0.

**Is there a fix for CVE-2026-48817?** Yes. starlette (PyPI): upgrade to 1.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48817 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48817?** Check whether you run Kludex Starlette-Auth-Toolkit or starlette (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- starlette (PyPI): upgrade to 1.1.0 or later

  ```sh
  pip install "starlette>=1.1.0"
  ```


## Technical details

A vulnerability in Starlette's HTTPEndpoint class (and derived frameworks like FastAPI) allows for unsafe reflection via the HTTP method name. When a request is dispatched, the framework converts the HTTP method to lowercase and uses `getattr` to invoke the corresponding method on the class without validating it against a whitelist of standard HTTP verbs. If an HTTPEndpoint is registered via a Route without an explicit `methods` argument, an attacker can send a non-standard HTTP method (e.g., an internal helper name) to execute arbitrary class methods that accept a request argument. This bypasses the authorization logic typically residing in standard handlers like `get()` or `post()`. The issue is fixed in version 1.1.0 by restricting dispatch to standard HTTP verbs.

## Affected products

- Kludex Starlette <= 1.0.1

## Identifiers

- CVE-2026-48817
- GHSA-x746-7m8f-x49c
- PYSEC-2026-2280

## Timeline

- 2026-05-23: patched: Version 1.1.0 released
- 2026-05-23: advisory: GitHub Security Advisory GHSA-x746-7m8f-x49c published
- 2026-06-17: disclosed: CVE-2026-48817 published to NVD

## References

- [https://github.com/Kludex/starlette/releases/tag/1.1.0](https://github.com/Kludex/starlette/releases/tag/1.1.0)
- [https://github.com/Kludex/starlette/security/advisories/GHSA-x746-7m8f-x49c](https://github.com/Kludex/starlette/security/advisories/GHSA-x746-7m8f-x49c)

## Related threats

- [PYSEC-2026-1941 - Starlette has possible denial-of-service vector when parsing large files in multipart forms](https://junglewise.ai/threats/cve-2025-54121-starlette-denial-of-service-in-multipart-form-parsing)
- [PYSEC-2026-1943 - Starlette Denial of service (DoS) via multipart/form-data](https://junglewise.ai/threats/cve-2024-47874-starlette-denial-of-service-dos-via-multipart-form-data)
- [Starlette denial of service via resource limit bypass in request.form](https://junglewise.ai/threats/cve-2026-54283-starlette-denial-of-service-via-resource-limit-bypass-in-request)
- [Kludex Starlette hostname spoofing via unvalidated request path](https://junglewise.ai/threats/cve-2026-54282-kludex-starlette-hostname-spoofing-via-unvalidated-request-path)
- [Kludex Starlette SSRF and NTLM credential theft in StaticFiles on Windows](https://junglewise.ai/threats/cve-2026-48818-kludex-starlette-ssrf-and-ntlm-credential-theft-in-staticfiles-on)