What happened
CISA added CVE-2026-48710 to KEV on Sept 2, 2026, confirming active in-the-wild exploitation of this HTTP request/response smuggling flaw in Starlette. Because Starlette underlies vLLM, LiteLLM, and numerous MCP server implementations, the bug directly threatens the authentication boundary of widely-deployed AI serving and gateway infrastructure. Researchers report it has been chained with a LiteLLM command-injection flaw for unauthenticated RCE.
Why it matters
This is a foundational-layer flaw in the web framework AI infrastructure is built on top of — a single vulnerability with cascading impact across the model-serving and agent-tooling ecosystem, and it is under confirmed active exploitation.
Attack vector
A single malformed character (/, ?, or #) injected into the Host header shifts path-boundary reconstruction, causing request.url.path to diverge from the path actually dispatched by the router — allowing attackers to bypass path-based authentication/authorization middleware that trusts the reconstructed URL path.
Affected systems
Kludex Starlette (ASGI framework underlying vLLM, LiteLLM, FastAPI-based MCP servers)
Mitigation
Apply vendor patch per Starlette GHSA-86qp-5c8j-p5mr; audit any AI gateway/MCP server relying on Starlette path-based auth middleware.