A critical security flaw known as BadHostCVE-2026-48710, also identified as X41-2026-002, GHSA-86qp-5c8j-p5mr, and PYSEC-2026-161, was discovered by X41 D-Sec during an OSTIF-sponsored audit [1, 2]. The vulnerability lets attackers forge the request.url.path by manipulating the HTTP Host header, bypassing path-based authentication middleware [1, 2].
Thousands of applications built on FastAPI and Starlette are affected, including popular AI frameworks such as vLLM, LiteLLM, MCP servers, and AI agent systems [1, 2]. The issue stems from Starlette versions below 1.0.1, which build the request.url field by directly concatenating the Host header with the request path, resulting in incorrect path values if the Host header is maliciously crafted [1, 2].
ASGI servers like Daphne, Granian, Gunicorn, Hypercorn, Anycorn, and Uvicorn pass the raw Host header unchanged to the framework, making the attack possible unless a reverse proxy filters or sanitizes the header first [1, 2]. This security gap puts MCP servers and associated AI infrastructure, including large language model inference servers and agent frameworks, at heightened risk [1, 2].
To mitigate the risk, developers are advised not to rely on request.url.path in middleware for authentication checks. Instead, they should use the raw routing information from scope['path'], which comes directly from the HTTP request line and cannot be manipulated through the Host header [1, 2]. Authentication should be implemented using endpoint-level decorators such as Starlette's requires() or FastAPI's Depends() and Security(), rather than middleware depending on request.url.path [1, 2].
The vulnerability’s broad impact on Python web applications running vulnerable Starlette versions and ASGI servers underscores the need for urgent patching and review of authentication logic in affected projects [1, 2].