{"uuid": "41660d10-950b-43bf-bddf-542e7a697136", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48710", "type": "seen", "source": "https://bsky.app/profile/dragostech.bsky.social/post/3mmqjd6idtk2n", "content": "\ud83d\udea8CVE-2026-48710(\"BadHost\"): one character in a Host header bypasses path-based authorization across most of the Python AI stack.\n\nLives in Starlette, reaches FastAPI and through it: vLLM (where it was discovered), LiteLLM, TGI, MCP servers, agent harnesses, eval dashboards.\ncc \n@marver.bsky.social", "creation_timestamp": "2026-05-26T07:55:47.138306Z"}