Starlette Host‑Header Bug (CVE‑2026‑48710) Lets Attackers Bypass FastAPI Auth
A critical flaw in Starlette’s handling of the HTTP Host header (CVE‑2026‑48710) can trick middleware that relies on request.url.path, allowing authentication bypass in FastAPI‑based AI services. The issue affects all Starlette versions before 1.0.1, putting millions of AI agents at risk. Upgrading to Starlette ≥ 1.0.1 mitigates the exploit.