Critical vulnerability in Starlette framework exposes millions of AI servers to credential theft

A vulnerability tracked as CVE-2026-48710 (named BadHost) in Starlette, an open source framework that receives 325 million downloads per week, allows attackers to bypass path-based authorization by injecting a single character into the HTTP Host header. The vulnerability affects Starlette versions prior to 1.0.1, released Friday, and by extension impacts FastAPI, vLLM, LiteLLM, and other widely used Python frameworks.

Starlette serves as the base for FastAPI and other frameworks used to build services that connect to MCP servers (model context protocol servers that allow AI agents to access external resources like databases, email, and calendar accounts). BadHost is trivial to exploit against most systems without proper firewall configuration, making credential stores especially vulnerable to breach.

Secwest researchers described the vulnerability as allowing attackers to reach 'a large segment of the Python AI tooling ecosystem: vLLM (where the bug was discovered), LiteLLM, Text Generation Inference, most OpenAI-shim proxies, MCP servers, agent harnesses, eval dashboards, and model-management UIs.' X41 D-Sec, which discovered the flaw, classified it as having critical severity, while the official severity rating is 7 out of 10.