logoalt Hacker News

nickcwtoday at 7:37 AM2 repliesview on HN

If you read the advisory and are wondering what starlette is, from it's web page: starlette is a lightweight ASGI framework/toolkit, which is ideal for building async web services in Python.

It's used a lot in the data heavy AI world for it's efficiency shipping large files. This includes lots and lots of production servers.

From the advisory: this includes LLM inference servers like vLLM, LLM proxy servers like LiteLLM, AI agent frameworks, MCP gateways, and custom APIs. MCP servers are especially at risk because the MCP spec mandates unauthenticated OAuth discovery endpoints, providing a reliable path for exploitation.


Replies

alex_suzukitoday at 8:05 AM

Notably, Starlette powers FastAPI, an extremely popular Python framework for building HTTP services.

hsbauauvhabzbtoday at 9:02 AM

Ironically typing ‘make sure my server is secure’ into an LLM either wasn’t done, or missed it until now.

show 1 reply