Loading story…
A vulnerability in the Python ASGI framework Starlette allows attackers to bypass path-based authentication and authorization checks by sending malformed HTTP Host headers. Tracked as CVE-2026-48710 and dubbed BadHost, the flaw arises because affected Starlette versions reconstruct request.url from unvalidated Host header data, letting characters such as /, ?, or # poison URL parsing. In vulnerable deployments, middleware or application logic may inspect request.url.path as a harmless path while the ASGI router still processes the real protected path, enabling unauthorized access to endpoints such as admin panels, internal tools, and other restricted routes.
The issue affects Starlette versions before 1.0.1 and has broad downstream impact because Starlette underpins FastAPI and many internet-facing AI and API services, including MCP servers, OpenAI-compatible proxies, vLLM, LiteLLM, Ray Serve, BentoML, and related model-management interfaces. Researchers and advisories warned that exposed systems could leak sensitive data, credentials, API keys, and AI compute resources, with some reports noting possible follow-on risks such as SSRF or even RCE where privileged management endpoints are reachable. Starlette 1.0.1 fixes the bug by validating Host headers against RFC requirements and falling back to scope["server"] when malformed values are supplied; defenders were urged to upgrade, audit bundled dependencies, avoid making security decisions from request.url.path, and use scope["path"] or framework-native authorization controls instead.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
CVEReports published a technical write-up explaining how malformed Host headers containing delimiters can cause parser differentials between request.url.path and the ASGI router path. The report described how this can let attackers bypass path-based access controls and reach protected endpoints without authorization.
Belgium's CCB published a warning advisory about the Starlette vulnerability and related exposure in frameworks such as FastAPI, urging immediate patching.
A dedicated BadHost website for CVE-2026-48710 was published, indicating public tracking and branding of the Starlette Host-header authentication bypass issue.
Cyber Security News reported that X41 D-Sec discovered BadHost during an OSTIF-sponsored audit and described the flaw's impact on FastAPI- and Starlette-based AI infrastructure. The report highlighted risks to authentication, authorization, filtering, billing, and related middleware controls.
SC Media reported disclosure of the BadHost vulnerability in Starlette and noted that the issue was patched in version 1.0.1. The report emphasized potential security bypasses and sensitive data exposure in internet-facing and AI-related deployments.
Ars Technica reported that Starlette version 1.0.1 had been released on Friday to fix BadHost. It also said X41 D-Sec and Nemesis released an online scanner to help identify vulnerable servers.
A Reddit post on r/netsec warned users to update Starlette immediately because of a newly disclosed severe vulnerability affecting related software. The post was brief and did not include technical details, but it marked public community amplification of the issue.
OSTIF published expanded disclosure details for BadHost, citing slow patch adoption and additional vulnerable internet-exposed services. The disclosure said the issue was discovered by X41 D-Sec during a vLLM security audit managed by OSTIF and highlighted downstream risk across FastAPI and AI infrastructure.
OSV published DEBIAN-CVE-2026-48710, describing the Starlette Host-header vulnerability and stating that versions before 1.0.1 are affected. The entry identified upgrading to Starlette 1.0.1 or later as the remediation.
A GitHub security advisory disclosed that Starlette versions up to 1.0.0 improperly validated the HTTP Host header, enabling request.url.path poisoning and bypass of path-based security checks. The advisory recommended upgrading to a patched release that validates malformed Host values and falls back to scope["server"].
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
cvereports.com
Open sourceccb.belgium.be
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourceosv.dev
Open sourcereddit.com
Open sourcegithub.com
Open sourcebadhost.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA added **CVE-2026-42271** to its Known Exploited Vulnerabilities catalog after evidence emerged that attackers are exploiting a command injection flaw in BerriAI **LiteLLM**. The bug affects MCP server test endpoints in self-hosted LiteLLM deployments, where crafted `stdio` parameters can trigger arbitrary command execution on the proxy host. On its own, the flaw requires a valid proxy API key, but researchers reported it is being chained with **CVE-2026-48710** in **Starlette**—a Host header validation bypass known as **BadHost**—to bypass authentication and achieve unauthenticated remote code execution. The exposed attack path affects LiteLLM versions **1.74.2 through 1.83.6** when deployed with **Starlette 1.0.0 or earlier**, and researchers rated the combined chain as effectively **critical** with a CVSS score of **10.0**. Successful compromise can let attackers run OS commands, steal model provider credentials, API keys, secrets, and environment variables, and pivot into connected AI infrastructure. BerriAI patched the issue in **LiteLLM 1.83.7** by restricting the vulnerable test endpoints to the `PROXY_ADMIN` role, while defenders are being urged to upgrade LiteLLM and Starlette, limit network access to the affected endpoints, rotate stored credentials, and review logs for suspicious Host header and subprocess activity.
Jun 29, 2026
A critical vulnerability in **LiteLLM** tracked as `CVE-2026-49468` allows attackers to bypass authentication through **Host header injection** and reach protected management endpoints. The flaw affects LiteLLM versions earlier than **`1.84.0`** and stems from a mismatch in how the authentication layer evaluates routes versus how **FastAPI** ultimately dispatches them, creating a path for unauthenticated access under specific conditions. The issue is classified as **`CWE-290`** and has been rated **CVSS 9.5**, with researchers describing it as network-exploitable with low attack complexity and no user interaction required. The vulnerability was responsibly disclosed by **Le The Thang** of **KCSC** and **Kim Ngoc Chung** of **One Mount Group**, and LiteLLM maintainers have released a fix in version **`1.84.0`** with no configuration changes required. There is no confirmed evidence of active exploitation, and **LiteLLM Cloud** customers are reportedly not affected. Self-hosted deployments may also be shielded if upstream infrastructure such as **Cloudflare**, **WAFs**, reverse proxies with strict allowlists, or host-validating load balancers normalize or reject malformed Host headers before requests reach the application.
Jun 29, 2026
A high-severity **server-side request forgery** flaw tracked as `CVE-2026-63306` affects **stoatchat** versions before `0.13.5`, allowing unauthenticated attackers to abuse the `/proxy` and `/embed` endpoints with arbitrary URLs. The vulnerable endpoints reportedly lack DNS resolution filtering and private IP range validation, enabling requests to be routed toward internal network resources that should not be externally reachable. The issue can be used to enumerate internal services, fingerprint internal applications, and access cloud instance metadata endpoints, including by chaining redirects to reach otherwise restricted infrastructure. The vulnerability is classified as `CWE-918` and carries a CVSS v3.1 vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N`; advisory data also indicates proof-of-concept exploitation and automatable attack potential. Version `0.13.5` is listed as unaffected.
Jul 17, 2026