Log in Start free

Vulnerability · Published Jun 17, 2026 · Assigned by GitHub_M

CVE-2026-48818Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows

High 7.5

In plain English

A high-severity server-side request forgery in starlette from Kludex. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 69.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker.com\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account’s NTLMv2 credentials for offline cracking or relay even though the HTTP response is only a 404. The issue affects default follow_symlink=False deployments, including frameworks built on Starlette such as FastAPI; POSIX systems and follow_symlink=True are unaffected. The issue is fixed in 1.1.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIstarlette1.1.0PYSEC-2026-2281
PyPIstarlette1.1.0GHSA-wqp7-x3pw-xc5r
Ubuntu:22.04:LTSstarletteno fix listedUBUNTU-CVE-2026-48818
Ubuntu:24.04:LTSstarletteno fix listedUBUNTU-CVE-2026-48818
Ubuntu:25.10starletteno fix listedUBUNTU-CVE-2026-48818
Ubuntu:26.04:LTSstarletteno fix listedUBUNTU-CVE-2026-48818
Ubuntu:26.10starletteno fix listedUBUNTU-CVE-2026-48818

Affected products (as reported)

VendorProductVersions
Kludex starlette < 1.1.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References