BadHost Vulnerability Exposes AI Agents, Evaluators, and LLM Gateways
Scored daily by a customisable AI persona to surface the most relevant engineering leadership news.
Critical vulnerability in Starlette affecting AI agents, highly actionable and relevant to security and AI infrastructure.
BadHost (CVE-2026-48710) is a high-severity authentication bypass in Starlette, affecting 325M weekly downloads, discovered by Secwest and X41 D-Sec during a vLLM audit. Attackers exploit malformed Host headers containing /, ?, or # to bypass path-based access controls, exposing AI agents, LLM gateways, and MCP servers often deployed without reverse-proxy protection. The vulnerability spans three layers—ASGI servers, Starlette, and middleware—and despite a moderate CVSS score of 6.5, researchers argue it should be critical due to downstream impact and poor patch adoption.