Millions of AI agents imperiled by critical vulnerability in open source package - Ars Technica

Overview

Millions of AI agents imperiled by critical vulnerability in open source packagevar abtest_2156326 = new ABTest(2156326, 'click');

“Bad Host” was found in Starlette, a package with 325 million weekly downloads.

Details

Millions of AI agents and tools around the world have been imperiled by a critical vulnerability that can allow hackers to breach the servers running them and make off with sensitive data and credentials to third-party accounts, a security researcher is warning.

The vulnerability is present in Starlette, an open source framework that its developer says receives 325 million downloads per week. Thousands of other open source projects are also vulnerable because they require Starlette to work. The framework is an implementation of the ASGI (asynchronous server gateway interface), which allows large numbers of requests to be efficiently processed simultaneously. Starlette is the base of Fast API and other widely used frameworks for building services in Python apps, as well as many others.

Trivial to exploit, millions of servers exposed

ASGI, and by extension Starlette, have access to servers running the MCP (model context protocol), which allows AI agents from major providers to access external sources, including user data bases, email and calendar accounts, and all manner of other resources. To connect with these external systems, MCP servers store credentials for each one, making them especially valuable storehouses for attackers to breach.

The vulnerability, tracked as CVE-2026-48710 and under the name Bad Host, is trivial to exploit and works against most systems that aren’t behind a properly configured firewall. Besides Fast API, other widely used packages—including v LLM, and Lite LLM—are also affected. Bad Host affects Starlette versions prior to 1.0.1, which was released Friday.

“A single character injected into the HTTP Host header bypasses path-based authorization in Starlette, the routing core of Fast API,” researchers from Secwest wrote. “Through Fast API, this primitive (now tracked as CVE-2026-48710 and branded Bad Host by the discoverers) reaches a large segment of the Python AI tooling ecosystem: v LLM (where the bug was discovered), Lite LLM, Text Generation Inference, most Open AI-shim proxies, MCP servers, agent harnesses, eval dashboards, and model-management UIs.”

Bad Host carries a severity rating of 7 out of a scale of 1 to 10. Secwest said the classification “materially understates” the threat it poses to people using other apps that depend on Starlette. X41 D-Sec, the security firm that discovered it, described it as having “critical severity.” X41 D-Sec partnered with fellow security firm Nemesis to create an online scanner that can check if a given server is vulnerable.

X41 D-Sec researcher Markus Vervier said a scan has revealed the following types of data are currently exposed:

Identity Verification – face analysis, KYB, live PII, internal codebase

Io T/Industrial – SSH to devices via bastion, remote code execution

Email/Saa S – full mailbox read/send/delete, S3 export, webhooks

HR/Recruitment – candidate PII, hiring pipeline data

CMS/Marketing – subscriber lists, send/schedule mass email campaigns

Document Management – read, upload, modify scanned documents

Cloud Monitoring – AWS topology, distributed traces, metric queries

Cybersecurity – asset inventory, live Nuclei scanner access

Personal Health/Finance – nutrition logs, expenses, subscriptions

The crux of the vulnerability is that Starlette accepts invalid host header values that cause authenticating apps that use Starlette’s request.url object to approve unauthorized access requests. X41 D-Sec said it has found authentication in multiple apps that rely on this call to be bypassed. Besides that, hacks can lead to SSRF (server-side request forgery) exploits and, in some cases, remote code execution. X41 D-Sec described it this way:

Starlette reconstructs the requested URL based on the HTTP Host request header and requested path, but does not perform any validation of the Host header value. This allows attackers to inject paths into the host part, prepending the actual path. However, routing in Starlette is based on the actual request path. This inconsistent interpretation of HTTP requests may lead to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. Starlette is the foundation of the Fast API Python framework.

Starlette reconstructs the requested URL based on the HTTP Host request header and requested path, but does not perform any validation of the Host header value. This allows attackers to inject paths into the host part, prepending the actual path. However, routing in Starlette is based on the actual request path. This inconsistent interpretation of HTTP requests may lead to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. Starlette is the foundation of the Fast API Python framework.

Company researchers added: “The routing algorithm of Starlette depends on the HTTP path, but the request.url.path attribute which is made available to middlewares and endpoints is based on the reconstructed URL. It is unexpected for users that request.url.path is different from the actual path requested over HTTP.”

The developer of Starlette didn’t immediately reply to an email seeking confirmation of the assessment and additional information.

With vulnerable versions of Starlette still widely used in production systems, people relying on any app that depends on Starlette—particularly, Fast LLM, v LLM, and Lite LLM—should at a minimum run the scanner on their systems to detect if vulnerable Starlette code is still in use there. Additional mitigation guidance is provided in the Nemesis and X41 D-Sec links above.

1.          I spent years forcing myself to finish The Witcher 3—don't repeat my mistake
   

2.          Analyst on China's spent rocket stages: "Things only continue to get worse"
   

3.          Citing Gandalf, Pope Leo says we must "disarm" AI
   

4.          US's big bet on quantum computing may not be entirely legal
   

5.          Amazing interior, controversial exterior: Ferrari's first electric car
   

Ars Technica has been separating the signal from the noise for over 25 years. With our unique combination of technical savvy and wide-ranging interest in the technological arts and sciences, Ars is the trusted source in a sea of information. After all, you don’t need to know everything, only what’s important.

Key Takeaways

• Millions of AI agents imperiled by critical vulnerability in open source packagevar abtest_2156326 = new ABTest(2156326, 'click');

• “Bad Host” was found in Starlette, a package with 325 million weekly downloads

• Millions of AI agents and tools around the world have been imperiled by a critical vulnerability that can allow hackers to breach the servers running them and make off with sensitive data and credentials to third-party accounts, a security researcher is warning

• The vulnerability is present in Starlette, an open source framework that its developer says receives 325 million downloads per week

• Trivial to exploit, millions of servers exposed