InfoQ - Security Vulnerabilities

BadHost Vulnerability Exposes AI Agents, Evaluators, and LLM Gateways

Sergio De Simone — Mon, 01 Jun 2026 14:00:00 GMT

BadHost is a high-severity authentication bypass vulnerability in the widely used Python web framework Starlette, with 325 million weekly downloads. The flaw allows attackers to use malformed HTTP Host headers to bypass path-based access controls and access sensitive AI agent infrastructure, among other systems.

By Sergio De Simone

A Trailing Slash Bypassed AWS API Gateway Authorization

Steef-Jan Wiggers — Mon, 01 Jun 2026 09:55:00 GMT

A security researcher found that adding a trailing slash to AWS HTTP API paths bypassed Lambda authorizer authentication entirely, enabling unauthenticated wire transfers at a fintech. The root cause is a path normalization mismatch between HTTP API's greedy route matching and its authorization layer. The same vulnerability class appeared in gRPC-Go via CVE-2026-33186.

By Steef-Jan Wiggers

Arm Open-Sources Metis, an AI Security Framework Outperforming Traditional SAST Tools

Sergio De Simone — Sat, 30 May 2026 19:00:00 GMT

Arm has open-sourced Metis, an agentic AI security framework designed to autonomously uncover complex software vulnerabilities. Unlike traditional pattern-based tools, Metis applies semantic reasoning to analyze cross-component dependencies and provides clear, natural language explanations for its findings.

By Sergio De Simone