
Critical Starlette bug imperils millions of AI agents
A vulnerability in the Starlette open source framework, which gets 325 million weekly downloads, puts millions of AI agents at risk. Tracked as CVE-2026-48710 and named BadHost, the flaw lets attackers bypass path-based authorization via a single character in the HTTP Host header. Affected packages include FastAPI, vLLM, and LiteLLM, and exploitation can expose sensitive data like clinical trial databases, email credentials, and cloud infrastructure details.
