BadHost: One Char Bypasses Host-Based Security Across the Python AI Stack
A critical security vulnerability known as BadHost has been identified in the Starlette framework, affecting many Python AI tools. The flaw allows a single character in the HTTP Host header to bypass authorization checks, posing significant risks to self-hosted and local LLM infrastructures. A patch has been released, but the severity of the issue may be understated according to its discoverers.
- ▪The vulnerability is tracked as CVE-2026-48710 and affects various Python AI tooling ecosystems.
- ▪A single character can exploit the flaw, making it trivial to automate and suitable for mass scanning.
- ▪The patch for the vulnerability is Starlette 1.0.1, which was released quietly.
Opening excerpt (first ~120 words) tap to expand
.fe-6a153c3995d2ee0bfb56739c { --grid-gutter: calc(var(--sqs-mobile-site-gutter, 6vw) - 11.0px); --cell-max-width: calc( ( var(--sqs-site-max-width, 1500px) - (11.0px * (8 - 1)) ) / 8 ); display: grid; position: relative; grid-area: 1/1/-1/-1; grid-template-rows: repeat(237,minmax(24px, auto)); grid-template-columns: minmax(var(--grid-gutter), 1fr) repeat(8, minmax(0, var(--cell-max-width))) minmax(var(--grid-gutter), 1fr); row-gap: 11.0px; column-gap: 11.0px; overflow-x: hidden; overflow-x: clip; } @media (min-width: 768px) { .background-width--inset .fe-6a153c3995d2ee0bfb56739c { --inset-padding: calc(var(--sqs-site-gutter) * 2); } .fe-6a153c3995d2ee0bfb56739c { --grid-gutter: calc(var(--sqs-site-gutter, 4vw) - 11.0px); --cell-max-width: calc( ( var(--sqs-site-max-width, 1500px) -…
Excerpt limited to ~120 words for fair-use compliance. The full article is at secwest.net - secure virtual engagement.
Discussion
0 commentsMore from secwest.net - secure virtual engagement
