A critical vulnerability, CVE-2026-48710, known as "BadHost," has been discovered in the Starlette Python web framework, affecting millions of AI agents and machine learning tools. Starlette, which receives 325 million downloads weekly, is foundational to FastAPI and other Python async projects, significantly broadening the impact of this flaw. The vulnerability allows attackers to manipulate the HTTP Host header to bypass authentication, potentially accessing sensitive data and credentials without needing sophisticated exploits. The issue affects all Starlette versions prior to 1.0.1, with patches now available. This vulnerability is particularly concerning due to its impact on widely used frameworks like FastAPI, vLLM, and LiteLLM, as well as MCP servers that support AI agent tooling. The discovery of BadHost highlights ongoing security challenges in AI frameworks, urging immediate updates to mitigate risks.