CVE-2026-48710 Starlette Host-Header Auth Bypass (opens in new tab)

Covered by 11 sources including DEV Community, infoworld.comDiscussed on Lobsters

Scan your Starlette or FastAPI server for CVE-2026-48710 (BadHost): a critical auth bypass via Host header injection affecting MCP servers, LLM proxies, AI agent frameworks, and thousands of Python ASGI applications.

Read the original article

Sign in to keep reading the full article.

Sign Up Log In

Covered in 11 articles

DEV Community·

CVE-2026-48710: CVE-2026-48710: Starlette BadHost HTTP Host-Header Path-Poisoning and Authentication Bypass

Discussed on DEV

infoworld.com·

FastAPI-based AI tools exposed to authentication bypass by flaw in Starlette framework

InfoQ·

BadHost Vulnerability Exposes AI Agents, Evaluators, and LLM Gateways

View all 11 ›