CVE-2026-48710: 'BadHost' Auth Bypass in Starlette Exposes Millions of AI APIs

A critical authentication-bypass vulnerability — CVE-2026-48710, nicknamed “BadHost” — was publicly disclosed on May 22, 2026, and affects every version of Starlette before 1.0.1. If you run FastAPI, vLLM, LiteLLM, or any MCP server in production, read this before doing anything else.

What the bug does. Starlette is the ASGI framework that FastAPI is built on. It processes HTTP Host headers to resolve request routing. BadHost exploits the way Starlette parses those headers: an unauthenticated attacker can inject a single character — /, ?, or # — into the Host field. Starlette then misparses the request path, causing path-based authentication middleware to evaluate the wrong route and silently pass the request through without auth checks. The attacker reaches protected endpoints as if they were authenticated.

Blast radius. Starlette is downloaded more than 325 million times per week. That number understates the real exposure — because FastAPI uses Starlette as its routing core, virtually every FastAPI deployment is affected. The vulnerability also impacts vLLM (the dominant open-source LLM serving runtime), LiteLLM, and the growing ecosystem of MCP servers that power AI agent tool-calling. OSTIF’s Derek Zimmer publicly stated the official CVSS score of 6.5 (Moderate) “understates real-world impact.” X41 D-Sec, the German security firm that found the bug during an OSTIF-sponsored audit of vLLM, rated it 7.0 (High).

The discovery timeline is worth noting. X41 D-Sec found the bug in January 2026. The patch shipped as Starlette 1.0.1 on May 21. Public disclosure happened May 22 — giving operators exactly one day of lead time between the patch being available and the exploit being documented publicly. That’s not much runway for teams running large AI API surfaces in production.

What to do.

1. Upgrade Starlette to 1.0.1 immediately: pip install --upgrade starlette
2. If you’re on FastAPI, update that too — FastAPI pins a Starlette version, so you may need pip install --upgrade fastapi starlette together
3. Check your Host header handling at the edge (reverse proxy, load balancer) — reject requests with unexpected characters in the Host field as a defense-in-depth measure
4. Test your endpoints with the free scanner at badhost.org before and after patching

Broader context. This vulnerability emerged from an audit of vLLM specifically — which means the security community is starting to treat AI serving infrastructure with the same scrutiny historically reserved for web frameworks and databases. That’s overdue. The AI API layer has become production-critical infrastructure for thousands of companies, and its security posture has lagged behind its adoption curve. Expect more CVEs at this layer as audit coverage increases.

Sources

• CVE Record — CVE-2026-48710
• OSTIF — Disclosing the BADHOST Vulnerability in Starlette