SAN FRANCISCO — A critical vulnerability named BadHost (CVE-2026-48710) in the Starlette open-source framework imperils millions of AI agents and tools by enabling server breaches and theft of sensitive data and third-party account credentials. The flaw affects Starlette versions prior to 1.0.1, which was released on a Friday.

Starlette, an implementation of the asynchronous server gateway interface (ASGI), receives 325 million downloads per week according to its developer. It serves as the foundation for widely used Python frameworks including FastAPI, vLLM, and LiteLLM, all of which are impacted by the vulnerability. Thousands of other open-source projects that depend on Starlette are also at risk.

BadHost has a severity rating of 7 out of 10. Researchers from Secwest stated this "materially understates the threat it poses to users of apps dependent on Starlette." X41 D-Sec, the security firm that discovered BadHost, described it as having "critical severity." The vulnerability arises because Starlette accepts invalid HTTP Host header values, causing applications that use Starlette’s request.url object to approve unauthorized access requests.

"A single character injected into the HTTP Host header bypasses path-based authorization in Starlette, the routing core of FastAPI," researchers from Secwest said. "Through FastAPI, this primitive (now tracked as CVE-2026-48710 and branded BadHost by the discoverers) reaches a large segment of the Python AI tooling ecosystem: vLLM (where the bug was discovered), LiteLLM, Text Generation Inference, most OpenAI-shim proxies, MCP servers, agent harnesses, eval dashboards, and model-management UIs." X41 D-Sec researcher Markus Vervier said a scan revealed that exposed data includes Biopharma AI clinical trial databases and M&A data; SSRF Identity Verification systems containing face analysis, KYB, live PII, and internal codebases; IoT and industrial systems with SSH access and remote code execution; Email and SaaS platforms allowing full mailbox control; HR and recruitment systems with candidate PII; CMS and marketing tools with subscriber lists; document management systems; cloud monitoring dashboards; cybersecurity asset inventories; and personal health and finance logs.

Exploitation of BadHost can lead to server-side request forgery (SSRF) and, in some cases, remote code execution. X41 D-Sec partnered with security firm Nemesis to create an online scanner to help users check if their servers are vulnerable. People relying on apps that depend on Starlette—particularly vLLM, LiteLLM, and FastLLM—are advised to run the scanner to detect whether vulnerable Starlette code is still in use. The developer of Starlette did not immediately reply to an email seeking confirmation of the vulnerability assessment and additional information.