CVE-2026-48817: Starlette HTTPEndpoint Method Reflection Bypass

Technical summary

The vulnerability stems from HTTPEndpoint's request dispatch mechanism, which uses getattr() to dynamically look up handler methods by lowercasing the incoming HTTP method name without validation against a whitelist of standard HTTP verbs (GET, POST, PUT, DELETE, etc.). When a Route is instantiated without an explicit methods= parameter, all HTTP methods are implicitly permitted. If an HTTPEndpoint subclass defines additional methods—such as internal utilities or helpers—whose lowercased names collide with non-standard HTTP method names an attacker supplies, those methods execute as request handlers. This bypasses authorization middleware and input validation typically applied only to intentional public handlers. The vulnerability is classified as CWE-470 (Use of Externally-Controlled Input to Select Classes or Code), a type confusion issue where external input determines which code path executes.

Business impact

Organizations running vulnerable Starlette or FastAPI applications face unauthorized access to internal endpoint logic. An unauthenticated attacker could invoke helper methods, trigger unintended side effects, or extract sensitive data if such methods are exposed. The risk is heightened in multi-tenant or public-facing APIs where endpoint classes might contain credential-handling, database manipulation, or administrative utilities. The CVSS score of 5.3 (Medium) reflects the integrity impact: there is no confidentiality or availability loss in the base score, but the integrity threat is meaningful if internal methods perform state changes.

Affected systems

Starlette versions 1.0.1 and earlier are vulnerable. This includes any application using Starlette directly or indirectly through FastAPI (which depends on Starlette). The exposure is limited to HTTPEndpoint subclasses registered via Route(...) without an explicit methods= parameter and that define additional methods matching non-standard HTTP verb names. Applications using only standard handler method naming (e.g., get(), post()) or those that explicitly constrain methods via the methods= argument are not vulnerable. Applications using APIRouter or simpler function-based endpoints in FastAPI may have lower exposure depending on their architecture.

Exploitability

Exploitation requires no authentication, no special network position, and no user interaction. An attacker simply sends an HTTP request with a crafted method name to a registered endpoint URL. The attack surface depends on the application's endpoint design: only endpoints with unprotected internal methods matching potential HTTP verb names are exploitable. Discovery is possible through fuzzing or reverse engineering if the application source is inspectable. The barrier to exploitation is low; the main constraint is identifying which internal methods exist on vulnerable endpoint classes.

Remediation

Upgrade Starlette to version 1.1.0 or later. For FastAPI users, upgrade to a version that depends on patched Starlette (verify the FastAPI release notes). As an interim measure, explicitly define the methods= parameter when registering HTTPEndpoint subclasses via Route(...), and avoid naming internal helper methods after potential HTTP verbs. Review endpoint class definitions for any methods that accept a request argument and return a response, as these could be accidentally exposed.

Patch guidance

Update Starlette dependency to version 1.1.0 or later in your requirements.txt, pyproject.toml, or equivalent dependency file. If using FastAPI, check the FastAPI changelog to identify which version includes the patched Starlette dependency and upgrade accordingly. Test your application after patching, especially any HTTPEndpoint-based routes, to ensure routing behavior is unchanged. Verify that your CI/CD pipeline and dependency lock files are updated to prevent regression.

Detection guidance

Monitor application logs for unusual HTTP method names being sent to your endpoints (methods outside the standard GET, HEAD, POST, PUT, DELETE, PATCH, OPTIONS, TRACE, CONNECT set). If possible, review endpoint class definitions in your codebase for HTTPEndpoint subclasses registered without explicit methods= parameters and flag those for inspection. Network telemetry that shows requests with non-standard verbs to API endpoints may indicate probing or exploitation attempts. Check application version pinning to confirm Starlette < 1.1.0 is no longer in use.

Why prioritize this

Although the CVSS score is Medium (5.3), prioritization depends on your use of Starlette or FastAPI with HTTPEndpoint-based routing and the presence of internal methods on those endpoints. If you use HTTPEndpoint and cannot immediately patch, implement the interim measure of setting explicit methods= parameters. FastAPI users relying on simpler function-based endpoints face lower risk. Organizations with public APIs or multi-tenant applications should prioritize patching to eliminate the unauthorized-access vector. The lack of KEV status or known active exploitation reduces urgency slightly, but the simplicity of exploitation warrants timely patching once dependencies are clear.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects: Network (AV:N) exploitability without authentication (PR:N, UI:N), low attack complexity (AC:L), and integrity impact (I:L) with no confidentiality or availability loss in the base score. The severity is Medium rather than High because it requires a specific application architecture (unprotected internal methods on HTTPEndpoint classes). The score does not account for the ease of identifying or weaponizing internal method names, which could elevate real-world risk beyond the numeric score if your application exposes sensitive helpers.

Frequently asked questions