erroneo.us
Search all guides⌘K

Digest · Thursday

Security digest: May 21, 2026

1 editorial brief, 2 known exploited (cisa kev) additions and 7 critical advisories.

All digests · RSS · Markdown

Take stock

  • Patch this week: BadHost. Teams running Starlette or FastAPI apps, or Python AI infrastructure built on them (LiteLLM, vLLM, MCP servers), whose middleware checks request.url or request.url.path, especially with uvicorn, hypercorn, granian or daphne exposed without a reverse proxy.
  • Do you run any of these? Trend Micro Apex One, Langflow Langflow. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-06-04.
  • npm: 3 critical advisories (@hulumi/policies, @boxlite-ai/boxlite). Check with npm audit (or: npm ls <package>).
  • PyPI: 3 critical advisories (pyfory, boxlite). Check with pip-audit (or: pip show <package>).
  • Go: 3 critical advisories (github.com/boxlite-ai/boxlite/sdks/go, github.com/fission/fission). Check with govulncheck ./....
  • crates.io (Rust): 2 critical advisories (boxlite, boxlite-cli). Check with cargo audit.
  • Composer (PHP): 2 critical advisories (twig/twig, concrete5/concrete5). Check with composer audit.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Patch this week

· Vulnerability · CVE-2026-48710

Starlette BadHost: Host Header Auth Bypass in CISA KEV

Bump starlette to 1.0.1 or later in every Python service this week; it is urgent where an ASGI server faces untrusted clients directly and middleware makes security decisions from request.url.

Must act: Teams running Starlette or FastAPI apps, or Python AI infrastructure built on them (LiteLLM, vLLM, MCP servers), whose middleware checks request.url or request.url.path, especially with uvicorn, hypercorn, granian or daphne exposed without a reverse proxy.

Can relax: Apps that enforce auth per route with FastAPI Depends()/Security() or Starlette requires() and sit behind an RFC-compliant reverse proxy; they should still upgrade on a normal cycle.

  1. Find every installed Starlette: pip show starlette in each service and image, or search lockfiles for starlette.
  2. Upgrade to starlette 1.0.1 or later; on FastAPI older than 0.133.0, upgrade FastAPI too, then rebuild and redeploy images.
  3. Grep middleware for request.url and URL(scope=...) and move security checks to request.scope["path"] or per-route dependencies.

Read the brief →

Known exploited (CISA KEV) 2

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2026-34926Trend Micro Apex One
Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability		2026-06-04
CVE-2025-34291Langflow Langflow
Langflow Origin Validation Error Vulnerability		2026-06-04

Critical advisories by ecosystem 7

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Go 3

Check: govulncheck ./...

npm 3

Check: npm audit (or: npm ls <package>)

PyPI 3

Check: pip-audit (or: pip show <package>)

Composer (PHP) 2

Check: composer audit

crates.io (Rust) 2

Check: cargo audit