Critical ‘BadHost’ flaw in Starlette lets attackers bypass auth in FastAPI apps
The newly disclosed CVE‑2026‑48710 in the Starlette ASGI framework, which underpins FastAPI, enables authentication bypass through a malicious Host header. This ‘BadHost’ vulnerability can compromise millions of AI agents and LLM inference services that rely on Starlette’s routing.