Millions of AI agents imperiled by critical vulnerability in open source package

A critical vulnerability in the open source framework Starlette is imperiling millions of AI agents and tools worldwide, potentially allowing hackers to breach servers and access sensitive data and credentials. This vulnerability, known as BadHost (CVE-2026-48710), affects systems using Starlette versions prior to 1.0.1 and is easy to exploit on servers not behind a properly configured firewall. The flaw impacts various widely used packages in the Python AI ecosystem, including FastAPI, vLLM, and LiteLLM. Security researchers have highlighted the seriousness of this vulnerability, with a severity rating of 7 out of 10 and warnings that it poses a significant threat to users of apps relying on Starlette.