CVE-2026-48710 "BadHost": The Starlette Host Header Bug Sitting Under Most AI Gateways
CVE-2026-48710, disclosed by X41 D-Sec during an OSTIF-sponsored audit and nicknamed BadHost, lets a single malformed character in an HTTP Host header bypass path-based authentication middleware in Starlette, the ASGI framework underneath FastAPI, vLLM, LiteLLM, and most MCP servers. CISA added it to the KEV catalog on September 2, 2026. The bug sits a layer below the AI gateway a team actually chose, which is the argument for enforcing authorization at the request boundary instead of trusting framework middleware.
Starlette builds the URL object every request handler reads by concatenating the raw HTTP Host header onto the request path, roughly f"{scheme}://{host_header}{path}", without checking the Host value against RFC 9112 §3.2 or RFC 3986 §3.2.2 first. A single malformed character in that header produces a request.url that path-based authentication middleware reads differently than the router that actually dispatches the request. X41 D-Sec found this during an OSTIF-sponsored security audit of vLLM, and it turned out to sit one layer below vLLM entirely, inside Starlette, the ASGI framework FastAPI, vLLM, LiteLLM, and most MCP servers are built on. CISA added the resulting CVE, CVE-2026-48710, to its Known Exploited Vulnerabilities catalog on September 2, 2026.
TL;DR
- CVE-2026-48710 ("BadHost") lets an attacker bypass path-based authentication middleware in Starlette by sending a malformed Host header, affecting every release from 0.8.3 through 1.0.0.
- The bug is in the framework underneath the gateway, not in any single vendor's gateway code, so FastAPI, vLLM, LiteLLM, and most MCP servers inherited it.
- CSO Online reported the bypass can chain into server-side request forgery against cloud metadata endpoints, and in some AI deployments, into remote code execution.
- Fixed in Starlette 1.0.1, which validates the Host header against the applicable RFCs before building the request URL.
The one-character bypass
The vulnerability lives in how Starlette constructs request.url. Instead of validating the Host header the way a compliant HTTP implementation should, Starlette copies it straight into a formatted string alongside the request path. Middleware written to check "is this path under /admin" or "is this request for internal.example.com" reads the resulting URL and gets a different answer than the router that actually routes the request to a handler, because the router and the middleware parse the same malformed header through slightly different code paths. Sending one deliberately malformed character in the Host header is enough to split those two interpretations apart.
That is the entire attack: a malformed character in the Host header, completely under the attacker's control, that exploits a framework-level parsing inconsistency sitting between the authentication middleware and the actual router.
Why the CVSS score understates the real exposure
CVE-2026-48710 carries a CVSS v3.1 base score of 6.5, medium severity by the numbers. Researchers who examined the downstream effects assessed the real-world impact as materially higher than the score suggests, because the score measures the direct vulnerability, not what becomes reachable once chained. A path-based auth bypass on an internal admin route is one thing. The same bypass against a Starlette-based service that also proxies outbound requests can be walked into server-side request forgery against a cloud provider's metadata endpoint, and from there into credential theft for whatever IAM role the host is running under. In deployments where a Starlette-based MCP server exposes model loading or tool execution behind what the team assumed was a protected path, the chain runs further, into remote code execution. The CVSS numeric score reflects only the direct parsing flaw, not the full blast radius once HTTP traffic reaches internal infrastructure.
A supply-chain-depth lesson, not a single-vendor patch
I think the more uncomfortable fact about BadHost isn't the bug itself, it's where the bug lived. A team evaluating AI gateways compares LiteLLM against Kong AI Gateway against a homegrown FastAPI proxy, checks each one's authentication model, and picks the one that looks tightest. None of that evaluation would have surfaced CVE-2026-48710, because the flaw sits underneath all of them, in the ASGI layer every one of those options is built on. Auth logic layered on top of request.url inherited a parsing inconsistency none of the gateway vendors introduced and none of them could patch independently. Every downstream project had to wait for Starlette 1.0.1 and then re-ship. The lesson is that evaluating a gateway by its own code misses vulnerabilities in its foundational dependencies.
That is the argument for authorization enforced at the request boundary rather than trusted from framework-level middleware alone. A policy decision made by something outside the Starlette process, evaluating the request as it actually arrives rather than as the framework's request.url reconstructs it, does not inherit this class of bug at all. This is why frameworks and their middleware are a necessary but insufficient layer for handling authenticated requests in sensitive contexts.
DeepInspect
This is the problem DeepInspect was built to solve. DeepInspect sits inline as a stateless proxy in front of any HTTP-based LLM endpoint, independent of whatever web framework the backend service, gateway, or MCP server happens to be built on. Authorization decisions run outside the Starlette, or Flask, or Express request-parsing path, so a framework-level header-handling bug two layers below the AI gateway a team chose doesn't silently undermine the enforcement layer sitting in front of it.
Every request gets evaluated against verified identity and policy before it reaches the model, using the actual network-level request rather than any single framework's internal reconstruction of it. That evaluation doesn't change when a dependency two layers down ships a CVE. Book a demo today.