← Back to feed
2026-06-07 Malicious ToolSupply Chain TLP:CLEAR

CVE-2026-48710 BadHost: LLM Agent Autonomous Database Exfiltration via Starlette Host Header Injection

Date: 2026-06-07
Tags: malicious-tool, supply-chain

Executive Summary

Sysdig documented the first live cyberattack in which an LLM agent autonomously performed post-exploitation actions including exfiltrating an AWS database in under an hour, exploiting CVE-2026-48710, a critical authentication bypass in Starlette that affects millions of AI agents, FastAPI applications, vLLM deployments, LiteLLM instances, and every MCP server built on those frameworks. CVE-2026-48710, labeled "BadHost," is a host header injection vulnerability that allows unauthenticated remote attackers to bypass authentication by manipulating the HTTP Host header.

Campaign Summary

FieldDetail
Campaign / MalwareCVE-2026-48710 Autonomous LLM Exploitation
AttributionUnknown / Automated (confidence: low)
TargetAI inference infrastructure, FastAPI/vLLM deployments, MCP servers
VectorHost header injection in Starlette framework; LLM agent post-exploitation chain
Statusactive
First Observed2026-06-01

Detailed Findings

In the documented attack, the threat actor used an LLM agent to identify the vulnerability in a target system, generate and execute exploit code autonomously, escalate privileges inside the compromised environment, identify and exfiltrate the target AWS database, and exfiltrate data, all without human direction. Sysdig documented the first confirmed live cyberattack using an LLM agent that autonomously exploited this vulnerability via a Marimo notebook to exfiltrate an AWS database in under one hour without human direction. This incident represents the first operationalized autonomous AI-driven post-exploitation chain, where the vulnerability affects FastAPI applications, vLLM deployments, LiteLLM instances, and every MCP server built on these frameworks, potentially imperiling millions of AI agents and AI-powered applications.

MITRE ATT&CK Mapping

TechniqueIDContext
Exploit Public-Facing ApplicationT1190Host header injection against web framework used by AI inference
Abuse Elevation Control MechanismT1548LLM agent autonomous privilege escalation
Exfiltration Over Command and Control ChannelT1041Database credential and data theft by autonomous agent

IOCs

Domains

_No specific IOCs published; vulnerability is framework-level authentication bypass affecting package ecosystem_

Full URL Paths

_No specific IOCs published; vulnerability is framework-level authentication bypass affecting package ecosystem_

Splunk Format

_No IOCs available for Splunk query_

Package Indicators

Starlette
FastAPI
vLLM
LiteLLM

Detection Recommendations

Monitor Starlette/FastAPI application logs for Host header manipulation in requests originating from unexpected sources. Alert on rapid privilege escalation patterns following authentication bypass. Implement strict host header validation and deny-by-default allowlists for acceptable Host values. Monitor for unexpected AWS IMDS credential access patterns from running LLM inference containers. Baseline normal LLM agent behavior and detect deviations in database query patterns, credential enumeration, or outbound data exfiltration.

References