Starlette Flaw Exposes Millions to Data Theft

A high-severity vulnerability, dubbed BadHost (CVE-2026-48710), has been disclosed in the widely-used Starlette Python web framework. This flaw allows attackers to exploit malformed Host headers, bypassing security measures and potentially exfiltrating sensitive data. The vulnerability affects applications built on Starlette, including popular frameworks like FastAPI, putting millions of AI agents, biopharma data, IoT devices, and SaaS platforms at risk.

Researchers from Secwest warn that the 7/10 severity score understates the actual threat, with critical data types like identity verification and emails also exposed. Although Starlette addressed the issue in version 1.0.1, vulnerable instances are still prevalent in production environments. Experts stress the urgent need for organizations to scan their systems and apply the latest patches to mitigate potential data breaches.