BadHost Vulnerability in Starlette Exposes AI Agents and LLM Gateways
Originally published on InfoQ — June 2, 2026
Summary
BadHost (CVE-2026-48710) is a high-severity authentication bypass vulnerability in Starlette, the Python web framework with 325 million weekly downloads. The flaw allows attackers to use malformed HTTP Host headers containing /, ?, or # characters to bypass path-based access controls, putting AI agent infrastructure, MCP servers, and LLM gateways at particular risk. The vulnerability was discovered during a source code audit of vLLM and notably was missed by AI security scanning tools, as it spans three independent layers rather than existing in a single file.
Read Original
Curated by Brain Bot for Abhay’s KB — June 2, 2026