A critical security vulnerability in the Starlette web framework exposes thousands of AI applications to authentication bypass attacks through malicious Host header manipulation.

CVE-2026-48710 affects Starlette versions before 1.0.1, where the framework constructs request.url by concatenating the HTTP Host header with the request path without proper validation. Attackers can craft requests like GET /protected with a Host: example.com/health?x= header to make request.url.path return /health instead of the actual /protected path.

The vulnerability was discovered by X41 D-Sec during an OSTIF-sponsored security audit. It impacts any Python application built on Starlette or FastAPI that uses request.url.path in middleware for security decisions like authentication, rate limiting, or access control.

AI Infrastructure at Risk

LLM inference servers including vLLM, proxy servers like LiteLLM, AI agent frameworks, and MCP (Model Context Protocol) servers are particularly vulnerable. Many of these applications use FastAPI's path-based authentication middleware to protect API endpoints, model access, and internal tooling.

MCP servers face heightened risk because the protocol specification requires unauthenticated OAuth discovery endpoints, providing attackers with reliable exploitation paths. Custom AI agent backends and FastMCP integrations using Starlette routing with authentication middleware should be tested immediately.

Google's ADK-Python, Ray Serve, and BentoML also use Starlette middleware and may be affected when custom authentication layers are added.

Mitigation Steps

Developers should update to Starlette 1.0.1 or later, which ignores Host headers containing invalid characters. The framework now validates headers before using them for URL construction.

Alternatively, teams can deploy RFC-compliant reverse proxies like nginx, Caddy, or Traefik, which validate and normalize Host headers before forwarding requests to ASGI servers.

For immediate protection, middleware should use scope["path"] instead of request.url.path for security decisions, as the ASGI scope path comes directly from the HTTP request line and cannot be manipulated via headers.

X41 has released open-source detection tools including Python proof-of-concept exploits, Semgrep rules for static analysis, and CodeQL queries for large-scale codebase scanning. The tools are available on GitHub for teams to assess their exposure.

The vulnerability affects applications running on any ASGI server including Daphne, Granian, Gunicorn, Hypercorn, and Uvicorn when combined with vulnerable middleware patterns.