BadHost: Starlette flaw (CVE-2026-48710) exposes AI agents and MCP servers (May 2026)

What happened

In May 2026, CVE-2026-48710, nicknamed BadHost, was disclosed: a critical authentication bypass in Starlette, the Python framework underneath FastAPI. The fix shipped in Starlette 1.0.1. It was found by X41 D-Sec during an audit sponsored by OSTIF, and reported by Ars Technica.

Why it's serious: Starlette gets about 325 million downloads a week and sits under much of Python's AI infrastructure: vLLM, LiteLLM, MCP servers (which connect AI agents to tools and databases), Google ADK-Python, Ray Serve, BentoML and agent dashboards.

How it works

Starlette builds request.url by joining the Host header with the request path, without validating Host. An attacker sends something like Host: example.com/health?x=:

• the router dispatches to the real path (say, /admin);
• but the auth middleware sees the "poisoned" path (/health, which is public) and lets it through.

Result: any path-based security rule enforced in middleware can be bypassed with a single character in the header.

MCP servers are especially easy targets because the MCP spec requires public OAuth discovery endpoints, which makes them easy to find. In X41's scan, vulnerable systems exposed clinical-trial data, identity verification, full mailboxes, HR data and SSH access to industrial devices.

According to the report, even Claude Mythos didn't find the bug in Project Glasswing, because it comes from three layers that each behave correctly on their own.

What to do

1. Upgrade Starlette to 1.0.1 or later (and the FastAPI that pulls it in).
2. If you can't yet: replace request.url.path with request.scope["path"] in every middleware or dependency making security decisions.
3. Put a reverse proxy (nginx, Caddy, Traefik, HAProxy) in front that validates Host.
4. Audit container images and virtualenvs, which may pin old versions.
5. A free scanner is available at badhost.org.

Lesson

AI agent infrastructure grew too fast and inherited security assumptions nobody reviewed. If you run an MCP server or LLM proxy on FastAPI, treat this as a priority.

Sources

• The Agent Report (2026-05-28): https://the-agent-report.com/2026/05/badhost-starlette-cve-critical-ai-agent-vulnerability/

---

Running AI agents or MCP servers at your company? KGA IT reviews their security for free: kga-it.com.