Starlette maintainer Marcelo Trylesinski shares his perspective on CVE-2026-48710, a Host header manipulation vulnerability that can cause path-based authorization middleware to be bypassed. He explains the technical root cause — routing uses the raw HTTP path while request.url is reconstructed from the Host header, creating a divergence exploitable by attackers — and argues the vulnerability stems from an application pattern rather than Starlette itself. He also criticizes aspects of the disclosure process: an initial tight deadline imposed on unpaid maintainers, a suggestion to publish the advisory before a patch was ready, and the creation of a branded vulnerability landing site (badhost.org) that gave users no time to react. He recommends upgrading to Starlette 1.0.1 and advises against basing authorization on request.url.path, suggesting request.scope["path"] instead. He also highlights the growing burden of triaging security advisories, most of which are AI-generated noise.
