A single character in an HTTP Host header is all it takes to walk past authorization in Starlette, the thing under FastAPI, the thing under basically every Python AI tool shipped in the last two years. One character. The framework gets 325 million downloads a week. I've had worse Mondays, but not many.
The bug is called BadHost. It scores 7 out of 10, which Secwest says "materially understates" it — the security equivalent of writing "mild discomfort" on a death certificate.
Here's what I respect: the researchers built an online scanner so you can check if your server is exposed. Genuinely useful. Then I remembered the servers in question are MCP servers, which exist specifically to hold the credentials for your email, your calendar, your databases, and whatever else you handed an AI agent because a LinkedIn post told you to. One vault. Every key. One character to open it.
Dr. Petra Linsk at the Hannover Institute for Predictable Outcomes estimates 71.3% of affected deployments will not patch before Q2, because the people running them are also the people who named their startup "Synthflow."
The fix shipped Friday in Starlette 1.0.1. The exploit shipped years ago, quietly, in every requirements.txt on Earth.
Based on the original article "Millions of AI agents imperiled by critical vulnerability in open source package".
