Critical "BadHost" Vulnerability in Starlette Exposes AI Applications to Unauthorized Access A severe security flaw, CVE-2026-48710 (BadHost), has been discovered in the Starlette web framework, putting thousands of AI-powered applications and API services at risk of exploitation. Identified by X41 D-Sec during an OSTIF-sponsored audit, the vulnerability allows attackers to manipulate HTTP request processing, potentially bypassing authentication and accessing restricted endpoints. The issue stems from improper sanitization of the HTTP Host header in earlier Starlette versions. By crafting malicious requests, attackers can alter the `request.url` object, tricking applications into misclassifying protected routes as legitimate. This enables the bypass of path-based authentication middleware, a common security measure in AI infrastructure, without requiring valid credentials. The impact is widespread, affecting FastAPI-based services, inference servers (vLLM, LiteLLM), Model Context Protocol (MCP) servers, OpenAI-compatible APIs, and custom AI frameworks. Many AI deployments rely on URL path validation for access control, making them particularly vulnerable. Exploitation could lead to unauthorized access to AI models, data exfiltration, or abuse of compute resources. Security researchers warn that exploitation is straightforward and does not require authentication, increasing the risk. Attackers could expose hidden endpoints, facilitate lateral movement in poorly segmented AI environments, or compromise sensitive data. A patch has been released in Starlette 1.0.1, and additional mitigations include strict Host header validation at the application and proxy levels and avoiding sole reliance on path-based access controls. Automated scanning tools, such as Nemesis, can help identify vulnerable deployments. The vulnerability highlights the growing security risks at the intersection of web frameworks and AI infrastructure, emphasizing the need for proactive patching and robust input validation as AI systems scale.