CVE-2026-48817 Overview
CVE-2026-48817 is an access control weakness in Starlette, a lightweight Asynchronous Server Gateway Interface (ASGI) framework. Versions 1.0.1 and below dispatch HTTP requests inside HTTPEndpoint by lowercasing the HTTP method and resolving it through getattr without restricting the lookup to known HTTP verbs. When a developer registers an HTTPEndpoint subclass with Route(...) and omits the methods= argument, every method reaches the endpoint. Attackers can invoke internal helper methods named like non-standard verbs and bypass the authorization logic enforced by intended public handlers. The issue affects downstream frameworks such as FastAPI and is fixed in Starlette 1.1.0.
Critical Impact
Unauthenticated network attackers can reach unintended endpoint methods, exposing internal helpers and bypassing authorization checks built into the documented HTTP handlers.
Affected Products
- Starlette versions 1.0.1 and below
- FastAPI and other ASGI frameworks built on vulnerable Starlette releases
- Applications registering HTTPEndpoint subclasses via Route(...) without explicit methods= argument
Discovery Timeline
- 2026-06-17 - CVE CVE-2026-48817 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-48817
Vulnerability Analysis
The flaw resides in Starlette's HTTPEndpoint.dispatch logic. The framework converts the incoming HTTP method to lowercase and uses getattr(self, method_name) to locate a handler. The lookup does not validate the method against the standard set of HTTP verbs such as GET, POST, PUT, PATCH, DELETE, OPTIONS, and HEAD. Any attribute on the subclass that accepts a single request argument becomes addressable as a handler.
When a route is registered without methods=[...], Starlette does not filter inbound methods at the routing layer. The endpoint receives requests with arbitrary verbs, including custom strings supplied by the client. This converts an internal helper named, for example, validate or process into a reachable HTTP entry point [CWE-470].
Root Cause
The root cause is unsafe reflection through getattr combined with missing method allow-listing. Starlette trusts the client-supplied HTTP method string and uses it directly as an attribute name. The framework also fails to constrain method resolution to known verbs or to handlers explicitly decorated as request handlers.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker sends an HTTP request using a custom method name that matches an attribute on the target HTTPEndpoint subclass. The endpoint invokes that attribute as a handler, returning its response without executing the authorization checks present on the intended public verbs.
The vulnerability is exploited remotely through standard HTTP traffic. No verified exploitation code is published in the security advisory. See the GitHub Security Advisory for technical details on the affected dispatch path.
Detection Methods for CVE-2026-48817
Indicators of Compromise
- HTTP access logs containing non-standard method verbs such as custom strings matching internal helper names on HTTPEndpoint subclasses.
- Responses returned for requests using methods outside GET, POST, PUT, PATCH, DELETE, OPTIONS, and HEAD.
- Unexpected 2xx responses to requests that bypass typical authentication middleware.
Detection Strategies
- Inventory FastAPI and Starlette applications and identify routes registered with Route(endpoint_class) lacking an explicit methods= argument.
- Audit HTTPEndpoint subclasses for instance methods whose names could collide with arbitrary verbs, especially helpers taking one request-like argument.
- Inspect web server and reverse proxy logs for HTTP requests with uncommon method tokens reaching application backends.
Monitoring Recommendations
- Configure web application firewalls and reverse proxies to allow only the standard HTTP method set and reject custom verbs at the edge.
- Forward ASGI access logs into a centralized analytics pipeline and alert on requests using methods outside an explicit allow-list.
- Track 200-series responses correlated with non-standard methods as high-priority investigation events.
How to Mitigate CVE-2026-48817
Immediate Actions Required
- Upgrade Starlette to version 1.1.0 or later across all services and container images.
- Audit every Route(...) registration that uses an HTTPEndpoint subclass and add an explicit methods=[...] argument with the intended verbs.
- Rename or refactor internal helper methods on HTTPEndpoint subclasses so they cannot collide with attacker-supplied method names.
Patch Information
The maintainers fixed the issue in Starlette 1.1.0. The patched dispatcher restricts attribute lookup to a known set of HTTP verbs and the explicit methods= list. Review the GitHub Release Notes for the full change log and the GitHub Security Advisory for advisory metadata.
Workarounds
- Add methods=["GET", "POST", ...] to every Route(...) declaration that targets an HTTPEndpoint subclass until upgrade is complete.
- Move internal helpers off the endpoint class or prefix them with underscores and refactor callers, ensuring no attribute name matches a possible HTTP verb.
- Enforce method allow-listing at an upstream proxy or API gateway to reject requests with non-standard HTTP verbs before they reach the application.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
