Loading vulnerability…
BadHost
BadHost is a Host header validation vulnerability in Starlette versions before 1.0.1. Starlette reconstructs request.url using the HTTP Host header without validating its syntax, while its router dispatches requests using the raw ASGI scope path. Malformed Host values containing URI delimiters can cause request.url.path to differ from the path actually routed. Unauthenticated attackers can exploit this discrepancy to bypass middleware or endpoint security checks that use the reconstructed URL for path-based authentication or authorization decisions. Applications using Starlette transitively, including FastAPI-based services, are susceptible when they implement these vulnerable checks.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can bypass path-based security restrictions, exposing protected endpoints and permitting unauthorized access or actions. The direct impact depends on which controls rely on request.url rather than the routed ASGI path; the vulnerability does not independently provide arbitrary code execution. In affected LiteLLM deployments, chaining BadHost with CVE-2026-42271 removes the API-key requirement for vulnerable MCP test endpoints and enables unauthenticated command execution with the LiteLLM proxy process's privileges. This chain can expose provider credentials, runtime secrets, and database records and facilitate lateral movement, persistence, or cryptomining.
If you can’t patch tonight, do this now.
Until patching is complete, configure front-end proxies and load balancers to reject or safely normalize malformed Host headers before forwarding requests. Base path-sensitive authorization on the raw ASGI scope path used by routing rather than request.url.path. Restrict service exposure to trusted networks; in affected LiteLLM deployments, block external access to MCP test endpoints. Monitor malformed Host values and unexpected successful access to protected endpoints. If compromise is suspected, rotate gateway-managed credentials and investigate application-originated subprocess execution and persistence.
Patch, then assume compromise.
Upgrade Starlette to version 1.0.1 or later, including transitive dependencies and deployed application images. The fix validates Host values against RFC 9112 §3.2 and RFC 3986 §3.2.2 during URL construction and falls back to scope["server"] for malformed values. Debian provides backported fixes in 0.26.1-1+deb12u1 for bookworm and 0.46.1-3+deb13u2 for trixie. For LiteLLM deployments exposed to the command-execution chain, also upgrade LiteLLM to 1.83.7 or later and verify that the deployed Starlette dependency is fixed.
1 exploit validated by Mallory's analysis. Hidden: 4 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
144 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.