PERMISSION/PROTOCOL
Back to incident tracker

2026-05-26

CriticalMedia report

BadHost CVE-2026-48710: Single character in HTTP Host header bypasses auth on millions of AI agent MCP servers

A single injected character in the HTTP Host header bypasses path-based auth in Starlette/FastAPI — exposing biopharma DBs, mailboxes, IoT devices, and PII across millions of AI agent MCP servers.

Starlette / FastAPITool execution / MCPAuthentication bypass / MCP credential exposureMCP servers, FastAPI-based AI agent harnesses, vLLM/LiteLLM inference proxies, eval dashboards

What happened

Attacker injects a single character into the HTTP Host header of a request to a Starlette-based MCP server or AI agent harness, causing the server's auth middleware to evaluate the wrong request path and approve unauthorized access.

Why it matters

Confirmed exposed data types include: biopharma clinical trial databases and M&A data, full mailbox read/send/delete access, SSH lateral movement to industrial IoT devices via bastion, live PII and KYB data, candidate hiring pipeline data, AWS topology and distributed traces, subscriber lists with mass email capability, and raw financial and health records. Security researchers describe this as "materially understated" by the 7.0 CVSS score.

Missing authorization check

External authorization receipts for high-impact agent actions — independent of the MCP server transport layer. Even if the MCP server auth is bypassed, a PP receipt requirement means the attacker cannot produce a valid signed authorization for destructive or exfiltration actions.

Would PP block it?

For PP-gated actions (data mutations, credential use, external API calls), the attacker hitting a BadHost endpoint cannot produce a valid PP receipt from an external authority channel — the bypass is at the HTTP routing layer, not the PP signing layer. For non-gated read operations, PP provides no coverage: BadHost would succeed in exfiltrating data that doesn't require a receipt. Full coverage requires gating all sensitive reads, not just writes.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-05-26

    X41 D-Sec discovers CVE-2026-48710 (BadHost) in Starlette; Secwest co-publishes research documenting scope across vLLM, LiteLLM, TGI, most Python MCP server tooling.

  2. 2026-05-26

    Nemesis partners with X41 D-Sec to launch public scanner (mcp-scan.nemesis.services) to detect vulnerable servers.

  3. 2026-05-26

    Starlette 1.0.1 released with fix. Ars Technica publishes coverage. Researchers report confirmed in-the-wild exposure across biopharma, IoT, email/SaaS, and cloud monitoring.

  4. 2026-05-26

    CVSS 7.0 assigned; X41 D-Sec publicly states rating materially understates severity given the breadth of affected MCP infrastructure.

  5. Ongoing

    Millions of production servers still running pre-1.0.1 Starlette. Operators advised to run scanner and patch immediately.

Technical breakdown

  • Starlette reconstructs the request URL from the HTTP Host header and path, but does not validate the Host header value. An injected character causes request.url.path to differ from the actual HTTP path used by Starlette's router.
  • Auth middleware that relies on request.url.path (the reconstructed value) evaluates the wrong path — approving requests the router would route to protected endpoints.
  • FastAPI is built directly on Starlette, inheriting the vulnerability. vLLM, LiteLLM, Text Generation Inference, and most OpenAI-shim proxies use FastAPI, making the entire Python AI inference stack affected.
  • MCP servers are high-value targets: they store credentials for every external system they bridge. A BadHost bypass gives an attacker the keys to every system a compromised MCP server is authorized to reach.
  • In some configurations, the vulnerability leads to SSRF or full remote code execution, not just auth bypass — the auth bypass is the minimum impact case.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Tool execution / MCP. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
MCP server entry point, agent action authorization channel
Still needs
Read-only data access and reconnaissance that precedes any PP-gated action; lateral movement via compromised MCP credentials before a receipted action is triggered
Receipt required for
Any agent action touching external databases, credential stores, email systems, or infrastructure endpoints via MCP

PP's external authority chain operates independently of the MCP server transport. A BadHost bypass cannot forge a PP authorization receipt — receipts require independent channel authentication outside the compromised server. However, PP does not prevent read-only data access or lateral movement that doesn't require a PP-gated action.

Start small

Put the relevant gate at this action boundary.

This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop