access.redhat.comVendor advisory
https://access.redhat.com/errata/RHSA-2026:30087 CVE-2026-48818
HIGH
Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows
Record summary
CVE-2026-48818 has a selected CVSS score of 7.5 (high).
Description
Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker.com\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account’s NTLMv2 credentials for offline cracking or relay even though the HTTP response is only a 404. The issue affects default follow_symlink=False deployments, including frameworks built on Starlette such as FastAPI; POSIX systems and follow_symlink=True are unaffected. The issue is fixed in 1.1.0.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 17, 2026 · Source: CVE List
Affected products and versions
Showing 12 of 73| Product | Source | Version range | Status |
|---|---|---|---|
starletteBrowse Kludex / starlette | CVE List | < 1.1.0 | affected |
Exploit IntelligenceBrowse Red Hat / Exploit Intelligenceexploit-intelligence-tech-preview/vulnerability-analysis-rhel9Default status: unaffected | CVE List | Version data not supplied | |
Migration Toolkit for Applications 8Browse Red Hat / Migration Toolkit for Applications 8mta/mta-solution-server-rhel9Default status: unaffected | CVE List | Version data not supplied | |
OpenShift LightspeedBrowse Red Hat / OpenShift Lightspeedopenshift-lightspeed/lightspeed-ocp-rag-rhel9Default status: unaffected | CVE List | Version data not supplied | |
OpenShift LightspeedBrowse Red Hat / OpenShift Lightspeedopenshift-lightspeed/lightspeed-service-api-rhel9Default status: unaffected | CVE List | Version data not supplied | |
Default status: unaffected | CVE List | Version data not supplied | |
Default status: unaffected | CVE List | Version data not supplied | |
Default status: unaffected | CVE List | Version data not supplied | |
Default status: unaffected | CVE List | Version data not supplied | |
Default status: unaffected | CVE List | Version data not supplied | |
Default status: unaffected | CVE List | Version data not supplied | |
Default status: unaffected | CVE List | Version data not supplied | |
References
12access.redhat.comVendor advisory
https://access.redhat.com/errata/RHSA-2026:30088 access.redhat.comVendor advisory
https://access.redhat.com/errata/RHSA-2026:30089 access.redhat.comvdb entry
https://access.redhat.com/security/cve/CVE-2026-48818 RHBZ#2490020issue tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2490020 github.com
https://github.com/Kludex/starlette github.com
https://github.com/Kludex/starlette/commit/fd53168a7767b6b55ba5af787fd88f49e33cabc5 github.com
https://github.com/Kludex/starlette/pull/3287 github.com
https://github.com/Kludex/starlette/releases/tag/1.1.0 github.comConfirmation
https://github.com/Kludex/starlette/security/advisories/GHSA-wqp7-x3pw-xc5r github.com
https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-2281.yaml security.access.redhat.comx_sadp csaf vex
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48818.json