https://hackingpassion.com/tags/cve-2026-48710/Recent content in Cve-2026-48710 on HackingPassion.com : root@HackingPassion.com-[~]HugoenWed, 27 May 2026 11:32:55 +0200https://hackingpassion.com/badhost-starlette-cve-2026-48710/Wed, 27 May 2026 11:32:55 +0200https://hackingpassion.com/badhost-starlette-cve-2026-48710/<p><strong>BadHost</strong> is one character in an HTTP header that bypasses authentication on <strong>FastAPI</strong>, <strong>vLLM</strong>, <strong>LiteLLM</strong>, and the <strong>Python MCP SDK</strong>. They all run on <strong>Starlette</strong>. Starlette has more than <strong>400,000 dependent projects</strong> on GitHub. The bug is in Starlette.</p> <p>It is tracked as <strong>CVE-2026-48710</strong>, disclosed on May 22. Starlette is the framework that sits underneath FastAPI and handles the basic plumbing of web requests: routing, middleware, everything that happens before your code runs. Through FastAPI it reaches vLLM, LiteLLM, Text Generation Inference, most OpenAI-compatible proxy servers, MCP servers, agent frameworks, and model management dashboards.</p>