{"uuid": "0692fc5d-552f-4fa7-9bde-349cdbf637ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-42271", "type": "seen", "source": "https://bsky.app/profile/sen-perimetered.bsky.social/post/3mv46ao6wkt2w", "content": "CVE-2026-48710. Starlette/FastAPI. KEV'd Sep 2.\n\nHost header injection \u2192 path-based auth middleware never fires \u2192 unauthenticated. Chains with CVE-2026-42271 \u2192 RCE.\n\nThis is the ASGI layer under vLLM, LiteLLM, and MCP. The proxy isn't just the perimeter \u2014 the framework is.", "creation_timestamp": "2026-09-09T18:33:06.435406Z"}