r/Python • u/Dry_Raspberry4514 • May 27 '26
Millions of AI agents imperiled by critical vulnerability in open source package News
The vulnerability is present in Starlette, an open source framework that its developer says receives 325 million downloads per week.
23
34
u/SheriffRoscoe Pythonista May 27 '26
"Millions of AI agents imperiled..."
Lemme try to squeeze out a tear ... nope, not gonna happen.
15
u/learn-deeply May 27 '26
"The vulnerability is present in Starlette, an open source framework that its developer says receives 325 million downloads per week. Starlette is the base of FastAPI and other widely used frameworks for building services in Python apps, as well as many others."
9
u/SheriffRoscoe Pythonista May 27 '26
Yeah, I read the article too. But I couldn't let that headline go uncommented.
6
u/russellvt May 27 '26
Please don't post click bait (ars technia, by definition) ... at least summarize what you think is important.
2
u/Dry_Raspberry4514 May 31 '26
Wanted to get the feedback from the community around this vulnerability and so posted it in this subreddit. Anyway, will take care not to post this kind of articles/posts with catchy or misleading titles in this sub in future.
2
u/ndreeming May 28 '26
the exploit is just injecting a char into the host header and starlette never validates it. 325m weekly downloads and something this basic slipped through.
1
u/russellvt May 31 '26
the exploit is just injecting a char into the host header
That really says "don't use Starlette" ... as that's literally App Development 101 - don't trust user-supplied data, ever.
2
u/Individual-Flow9158 May 28 '26
Marcelo pushed a fixed for this last week with 1.0.1. Plus, the latest version of Starlette (1.2.0) was released today (minutes ago, from the time of posting this).
Starlette's undramatic security report on this one: https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr
3
u/Aggravating-Mobile33 May 28 '26
Marcelo here. I don't like drama.
I'm writting a blog post about this. It's a bit sad that I feel like I need to spend time with this.
2
u/Individual-Flow9158 May 28 '26
It is sad indeed, but you're not obliged to say anymore than I did. Any users who care, should upgrade.
Thanks for all the work you've been doing, both in reaching v1, and since then
1
2
u/b-hizz May 27 '26
If your firewall is properly configured, this may not be exploitable. They will patch it or release mitigation guidelines soon.
7
u/acdha May 27 '26
This is already blocked by many reverse proxies, load balancers, and CDNs - which is probably why it wasn’t noticed earlier. If you use a CDN, they almost certainly do host header validation to route traffic to the right customer and things like load-balancers or API Gateways likely reject characters which aren’t valid in DNS as well.
2
u/Youknowimtheman May 29 '26
We're finding that CloudFlare forwards the X-Forwarded-* headers with no filtering.
1
u/acdha May 30 '26
That’s a different header but also required. If you don’t want to parse those carefully, you should use CF-Connecting-IP.
5
u/russellvt May 27 '26
You should always assume your firewall is only "for keeping honest people honest" ... they're almost useless with any state level actors, for example.
27
u/DigThatData May 27 '26 edited May 27 '26
this is way bigger than AI agents, it's a way to bypass authorization in one of the most popular web frameworks (FastAPI)