Starlette BadHost CVE-2026-48710 auth bypass affects FastAPI vLLM LiteLLM MCP servers, 325M weekly downloads
Every FastAPI, vLLM, LiteLLM and MCP server running Starlette below v1.0.1 can be auth-bypassed by appending one character to the HTTP Host header, per OSTIF. Starlette ships about 325M downloads per week. CVE-2026-48710 (BadHost). Patch: Starlette 1.0.1 or read raw path from sco
Every FastAPI, vLLM, LiteLLM and MCP server running Starlette below v1.0.1 is exposed to an authentication bypass that needs no credentials and no exploit chain. The vulnerability, tracked as CVE-2026-48710 and named BadHost by the Open Source Technology Improvement Fund, lets an unauthenticated attacker slip past access controls by injecting a single malformed character into the HTTP Host header. According to OSTIF and CSO Online, a normal request to a protected /admin route returns a 403 Forbidden, but the same request sent with a Host header set to "foo?" returns 200 OK. The router serves the protected endpoint while middleware evaluates a different path and waves the request through. The blast radius is unusually large. Starlette ships around 325 million downloads per week and provides the routing foundation for FastAPI, vLLM, LiteLLM, Text Generation Inference, OpenAI-compatible API proxies, MCP servers, and most of the Python AI agent ecosystem. Any deployment that relies on path-based middleware to gate access to admin endpoints, internal tools, or model-serving routes inherits the flaw. Follow-on risks include server-side request forgery, credential exposure, and remote code execution on management or tool-execution interfaces. The fix released by the Starlette project validates the Host header and rejects malformed values starting in version 1.0.1. Teams that cannot upgrade immediately can mitigate by reading the raw path from request.scope["path"] inside any security-relevant middleware. Sources: OSTIF, CSO Online, InfoWorld, CCB Belgium.