A single stray character in an HTTP header is now enough to walk past authentication on a huge share of the Python services built in the last few years, including the AI agent stack most teams stood up in a hurry over the last twelve months.
The bug: a Host header that lies to your middleware
Starlette, the lightweight ASGI framework that FastAPI, vLLM, LiteLLM and a long list of MCP server implementations are built on top of, reconstructs request.url by concatenating the client-supplied Host header with the request path, then re-parsing the result. CVE-2026-48710, tracked by researchers as BadHost, exploits the fact that this reconstruction never validated the Host header against the grammar it is supposed to follow. Inject a /, ? or # character into the Host value, and request.url.path, the value most path-based authorization middleware actually checks, diverges from the path the underlying ASGI server used to route the request. The server executes one path. Your access control middleware evaluates a different one. An unauthenticated attacker needs no valid credentials and no action from a victim, just a single crafted header.
The flaw affects Starlette versions 0.8.3 through 1.0.0. A fix landed in 1.0.1.
Why this one lands harder than a typical framework CVE
Starlette pulls roughly 325 million downloads a week, and the projects sitting on top of it are exactly the ones European engineering teams have been racing to deploy: FastAPI for internal and customer-facing APIs, vLLM and LiteLLM for serving and routing to large language models, and a fast-growing population of MCP servers exposing tools to AI agents. Security researchers rated the base CVSS score at 6.5, but flagged that number as understating the real-world impact, since in several deployment patterns the auth bypass opens a path to server-side request forgery or remote code execution, not just an information leak. A free scanner is available at badhost.org for teams that want to check exposure before assuming they are fine.
A Belgian regulator called it out by name, and CISA confirms it is already being exploited
Belgium’s Centre for Cybersecurity (CCB) issued a “patch immediately” advisory specifically naming Starlette and FastAPI, urging organisations to update with the highest priority after testing. CISA added CVE-2026-48710 to its Known Exploited Vulnerabilities catalog on September 2, which means this is not a theoretical risk sitting in a CVSS spreadsheet, it is being exploited against real targets right now. If your organisation runs anything built on FastAPI, or has stood up vLLM, LiteLLM or an MCP server anywhere in its infrastructure in the last two years, that dependency is worth checking today rather than at the next scheduled patch cycle.
What to check before you assume you are covered
Pin every transitive dependency, not just your direct pip install. Starlette rides in underneath frameworks that many teams never audit directly, which is precisely how a fix released weeks ago can still be sitting unpatched three layers down in a production image. Anyone who deployed an AI agent, LLM gateway, or MCP-based tool integration this year should treat that stack as a priority target for this check, since it is exactly the population the researchers flagged as most exposed.
If you need help auditing your dependency tree for BadHost exposure, patching it safely across a fleet of services, or reviewing how AI agent infrastructure gets approved and deployed inside your organisation in the first place, contact Excello Digital. We help European engineering teams close gaps like this before a regulator or an attacker finds them first.