Mcpm: Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname (CVE-2026-54282)

In affected versions of mcpm's Starlette, the HTTP request path is concatenated directly after the host without validating that it begins with a '/'. When a request path lacks a leading slash (e.g., '@google.com'), the reconstructed request URL is parsed such that the hostname becomes attacker-controlled (e.g., 'google.com'). This occurs because the URL is rebuilt as '{scheme}://{host}{path}' and re-parsed, causing the path to be interpreted as userinfo and hostname per RFC 3986. This vulnerability can mislead code that uses request.url.hostname, request.url.netloc, or request.url for security-sensitive decisions. Exploitation requires an ASGI server forwarding a request-target lacking a leading slash into scope['path']. The exposure is limited to middleware or handlers that inspect request.url before routing or in 404/exception handlers. A patch is available that ensures the path does not cross into the URL authority.

Applications using affected versions that rely on request.url.hostname or related properties for security decisions such as host-based authorization, redirects, SSRF targets, cache keys, or audit logs may be misled by attacker-controlled hostnames. However, the exploitability is limited because the malformed path does not match registered routes, resulting in 404 responses and no endpoint execution. The vulnerability primarily affects middleware or exception handlers that inspect the URL before routing. There is no known exploitation in the wild. The CVSS score is 3.7 (low severity) reflecting limited impact and complexity.

Upgrade to a patched version of mcpm that prevents the request path from crossing into the URL authority. The patch ensures that malformed paths such as '@google.com' are correctly interpreted as part of the path (e.g., 'http://localhost/@google.com') with the hostname remaining trustworthy. No other mitigations are indicated. Check vendor advisories for the exact patched versions.