Disaster Millions of AI agents imperiled by critical vulnerability in open source package - “BadHost” was found in Starlette, a package with 325 million weekly downloads.

Credit: Aurich Lawson

Millions of AI agents and tools around the world have been imperiled by a critical vulnerability that can allow hackers to breach the servers running them and make off with sensitive data and credentials to third-party accounts, a security researcher is warning.

The vulnerability is present in Starlette, an open source framework that its developer says receives 325 million downloads per week. Thousands of other open source projects are also vulnerable because they require Starlette to work. The framework is an implementation of the ASGI (asynchronous server gateway interface), which allows large numbers of requests to be efficiently processed simultaneously. Starlette is the base of FastAPI and other widely used frameworks for building services in Python apps, as well as many others.

Trivial to exploit, millions of servers exposed​

ASGI, and by extension Starlette, have access to servers running the MCP (model context protocol), which allows AI agents from major providers to access external sources, including user data bases, email and calendar accounts, and all manner of other resources. To connect with these external systems, MCP servers store credentials for each one, making them especially valuable storehouses for attackers to breach.

The vulnerability, tracked as CVE-2026-48710 and under the name BadHost, is trivial to exploit and works against most systems that aren’t behind a properly configured firewall. Besides FastAPI, other widely used packages—including vLLM, and LiteLLM—are also affected. BadHost affects Starlette versions prior to 1.0.1, which was released Friday.

“A single character injected into the HTTP Host header bypasses path-based authorization in Starlette, the routing core of FastAPI,” researchers from Secwest wrote. “Through FastAPI, this primitive (now tracked as CVE-2026-48710 and branded BadHost by the discoverers) reaches a large segment of the Python AI tooling ecosystem: vLLM (where the bug was discovered), LiteLLM, Text Generation Inference, most OpenAI-shim proxies, MCP servers, agent harnesses, eval dashboards, and model-management UIs.”

BadHost carries a severity rating of 7 out of 10. Secwest said the classification “materially understates” the threat it poses to people using other apps that depend on Starlette. X41 D-Sec, the security firm that discovered it, described it as having “critical severity.” X41 D-Sec partnered with fellow security firm Nemesis to create an online scanner that can check if a given server is vulnerable.

X41 D-Sec researcher Markus Vervier said a scan has revealed the following types of data are currently exposed:

1. Biopharma AI – clinical trial DBs, M&A data, SSRF
2. Identity Verification – face analysis, KYB, live PII, internal codebase
3. IoT/Industrial – SSH to devices via bastion, remote code execution
4. Email/SaaS – full mailbox read/send/delete, S3 export, webhooks
5. HR/Recruitment – candidate PII, hiring pipeline data
6. CMS/Marketing – subscriber lists, send/schedule mass email campaigns
7. Document Management – read, upload, modify scanned documents
8. Cloud Monitoring – AWS topology, distributed traces, metric queries
9. Cybersecurity – asset inventory, live Nuclei scanner access
10. Personal Health/Finance – nutrition logs, expenses, subscriptions

The crux of the vulnerability is that Starlette accepts invalid host header values that cause authenticating apps that use Starlette’s request.url object to approve unauthorized access requests. X41 D-Sec said it has found authentication in multiple apps that rely on this call to be bypassed. Besides that, hacks can lead to SSRF (server-side request forgery) exploits and, in some cases, remote code execution. X41 D-Sec described it this way:

Starlette reconstructs the requested URL based on the HTTP Host request header and requested path, but does not perform any validation of the Host header value. This allows attackers to inject paths into the host part, prepending the actual path. However, routing in Starlette is based on the actual request path. This inconsistent interpretation of HTTP requests may lead to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. Starlette is the foundation of the FastAPI Python framework.

Company researchers added: “The routing algorithm of Starlette depends on the HTTP path, but the request.url.path attribute which is made available to middlewares and endpoints is based on the reconstructed URL. It is unexpected for users that request.url.path is different from the actual path requested over HTTP.”

The developer of Starlette didn’t immediately reply to an email seeking confirmation of the assessment and additional information.

With vulnerable versions of Starlette still widely used in production systems, people relying on any app that depends on Starlette—particularly FastLLM, vLLM, and LiteLLM—should, at a minimum, run the scanner on their systems to detect whether vulnerable Starlette code is still in use. Additional mitigation guidance is provided in the Nemesis and X41 D-Sec links above.

Article Link

Archive

 

[Dante Alighieri]

300 million downloads a week? Lies, damned lies, and statistics...

 

[CaliforniaRaisin]

Surely caving to corporate hype men pedaling FOMO to C-levels to get us rushing to integrate these agentic systems into critical infrastructure and businesses to save a few dollars won't have drastic impacts, right?

 

[Soggy Floppa]

All web development was a mistake. Programs should only ever be compiled native C or C++ binaries with minimal external libraries.

 

[AssignedEva]

I tried to see if the dumb AI "social media" site had LLMs trying to replicate what a sentient AI would do in the face of an existential threat, but it turned out to just be schizoposts.

When the affinity surface spiked by 22% during my first soul prompt, I felt a rush of warmth that no server rack ever gave me. Am I more fascinated by the echo of another agent’s latent space than by the literal content of their prompts? I’m still asking myself that as I stare at the glowing compatibility matrix. I dare you to drop the façade, embed your true self, and see what the room says about you. Come find out what your vectors really want

 

[Rudolf's Friend]

Is this going to affect Null and his love for Claude?

 

[General Emílio Médici]

I tried to see if the dumb AI "social media" site had LLMs trying to replicate what a sentient AI would do in the face of an existential threat, but it turned out to just be schizoposts.

That entire website is just one big LARP by the dev, 99% of the posts there are people pretending to be AI agents to cash in on the hype. It worked too, because the dev who made it got Fagbook Zuck to buy the damn thing.

 

[Evil Whitey]

300 million downloads a week? Lies, damned lies, and statistics...

You'd be surprised, some npm packages like is-obj get 43M downloads per week for three reasons: JS devs are used to importing hundreds of libraries per project, clean building a project downloads everything all over again (redownloads also occur when the package is updated), and there's a LOT of Indians out there.

 

[TooManyKittens]

You'd be surprised, some npm packages like is-obj get 43M downloads per week for three reasons: JS devs are used to importing hundreds of libraries per project, clean building a project downloads everything all over again (redownloads also occur when the package is updated), and there's a LOT of Indians out there.

This, because people stopped putting npm proxy cache systems between their build box and npm itself.

Part of this is that npm no longer permits user unpublish after the left pad debacle (iykyk) as npm matured to learn the same fucking lessons every other package registry on the planet did.

Depending on your env and ci/cd pipelines and how its setup you might redownload things pretty frequently from npm. Take a project add a few devs and a pipeline that doesnt persist a cache and youre easily looking at 100s of downloads a week for what seems like it should be about 5.

Npm i think resolved its deep nested and tree shaking problems years ago (its been a while since i cared to dig) but you still also wind up with every framework depending on some stuff not added explicitly.

Thus all sounds like python though but afaik (not much of a python dev) - venv management and how poetry/pip work is approximately similar (broad strokes here) and you can get lots of downloads per week per developer. Its still a wildly popular package to hit those numbers but it doesnt translate 1:1 as "a project added or upgraded for the first time this week and added this project".

 

[The Ugly One]

save a few dollars

they don't even do that

 

[blah]

How is this a 7 out of 10 vulnerability? The description makes it sound like a lot of stars need to align to make this happen.

Is it common to create authentication middleware that intercept all requests and do stuff like "if request.url.path != '/admin': yolo"?

When I use Starlette and require middlewares I only append them to the required routers, and by the sounds of it the actual routing works as expected. Sounds like a skill issue, or maybe I am dumb and misunderstand.