{"uuid": "d7a4b95d-1b2d-48bc-97c9-899c15c005e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-48710", "type": "seen", "source": "https://bsky.app/profile/dragostech.bsky.social/post/3mmqixgpa4s2n", "content": "\ud83d\udea8 CVE-2026-48710(\"BadHost\"): one character in a Host header bypasses path-based authorization across most of the Python AI stack.\n\nLives in Starlette, reaches FastAPI and through it: vLLM (where it was discovered), LiteLLM, TGI, MCP servers, agent harnesses, eval dashboards.\n\ncc @marver.bsky.social", "creation_timestamp": "2026-05-26T07:49:13.496189Z"}