🛡️ CVE-2026-48710

The items that name it 7

• Inside 90 days of attacks on AI infrastructure
  writeup2026-08-27

  Starlette host header validation bypass, chained with CVE-2026-42271 to achieve fully unauthenticated RCE.

• When AI infrastructure becomes the target: Securing gateways and control points | Microsoft Security Blog
  article2026-08-26It is written here as CVE-2026-48710: Starlette host-header validation bypass that can weaken the authentication boundary in affected configurations.
• Vulnerability Garden
  tool2026-05-13
• PyRIT v1.1.0
  repoIt is written here as CVE-2026-48710 (starlette BadHost, resolved in PyRIT v0.14.0).

  starlette BadHost, resolved in PyRIT v0.14.0

• LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE
  article

  "BadHost" host header validation bypass vulnerability affecting Starlette (ASGI framework) versions <= 1.0.0; CVSS score 6.5. Can bypass LiteLLM authentication mechanism entirely. Chained with CVE-2026-42271 by Horizon3.ai to achieve unauthenticated remote code execution; combined CVSS score of 10.0

• CISA Adds Seven Known Exploited Vulnerabilities to Catalog | CISA
  advisory
• Warning: Vulnerability in Starlette framework and related frameworks like FastAPI exposes millions of servers to authentication bypass, Patch Immediately! | CCB Belgium
  advisoryIt is written here as CVE-2026-48710: BadHost, Starlette authentication bypass, CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N); page last updated 28/05/2026.

  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N