Framework
Lightweight Python ASGI framework for building asynchronous web services and APIs, serving as the foundation underlying FastAPI and other tools.
vLLM 0.32.0rc0 sets the --allowed-origins default to an empty list, where 0.31 and every release back to 0.6 allowed all origins. A dev.to write-up says browser UIs on another origin will break on upgrade while server-side clients keep working.
Reality
Lumen's Black Lotus Labs says the PoeLLM cryptomining botnet has compromised more than 2,100 servers, many running exposed LiteLLM or Ollama. Each host it takes then mines and scans for the next, so an AI server left open to the internet is attack surface to lock down.
Perspective Coverage
6 publishersReality
SonicWall's CVSS 10.0 SSRF chains into command execution on remote access appliances, and JFrog Artifactory hands unauthenticated attackers admin under default configuration. Reverse shells and miners are already landing.
Perspective Coverage
4 publishersReality
LiteLLM's MCP test endpoints let any valid proxy key run arbitrary commands on the gateway, rated CVSS 8.8. CISA added the flaw to its Known Exploited Vulnerabilities catalog on June 8, 2026, confirming exploitation in the wild.
Reality
CISA's exploited-vulnerability catalog now holds entries for LiteLLM, Kestra and Starlette, according to a dev.to writeup, and the quickstart docs for those tools still keep provider API keys in the process environment an attacker reads first.
Reality
A dev.to engineer ran three FastAPI apps against the same dist directory and found that a catch-all declared above /api/ping answers 200 with index.html, while the new frontend() helper answered correctly from the wrong position.
Reality
CVE-2026-48710 is in CISA's Known Exploited Vulnerabilities catalog, scored 6.5 by Starlette's maintainers and 10.0 by Horizon3.ai once chained with a LiteLLM command injection. Version 1.0.1 is the fix.
Reality
Starlette resolves the route after the middleware stack has already run, so a geolocation middleware fires on /health and /docs as well. A per-route dependency scopes the same lookup to the handlers that actually need it.
Reality
The upgrade request is an HTTP GET that carries session cookies cross-origin with no preflight, so CORS never sees it, and the frameworks that could check the Origin header for you mostly hand that job to your route code.
Reality
X41 D-Sec's proof of concept for CVE-2026-48710 is one unauthenticated GET whose Host header carries /public?bar=. Starlette sits underneath LiteLLM, vLLM and MCP servers, so the work starts with a dependency query.
Reality
Seven entries went into CISA's known-exploited catalog on 2 September. The 5 September fix date covers four of the six products named, and the two AI-stack entries are the ones most teams cannot locate in a dependency graph.
Reality
Ninety days of Wiz honeypot telemetry shows tooling written for LiteLLM's internals, including a config test endpoint that spawns whatever command it is handed and a miner whose output comes home inside the MCP protocol.
Reality
Three Microsoft investigations into AI middleware ended in stolen keys, persistence and compute abuse. The remediation list is ordinary infrastructure hygiene, applied to plumbing nobody inventoried.
Reality