Description (CNA)
Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker.com\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account’s NTLMv2 credentials for offline cracking or relay even though the HTTP response is only a 404. The issue affects default follow_symlink=False deployments, including frameworks built on Starlette such as FastAPI; POSIX systems and follow_symlink=True are unaffected. The issue is fixed in 1.1.0.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Kludex / starlette | affected < 1.1.0 |
CWE
CWE-918
References
- https://github.com/Kludex/starlette/security/advisories/GHSA-wqp7-x3pw-xc5r
- https://github.com/Kludex/starlette/pull/3287
- https://github.com/Kludex/starlette/commit/fd53168a7767b6b55ba5af787fd88f49e33cabc5
- https://github.com/Kludex/starlette/releases/tag/1.1.0
- https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-2281.yaml
ADP enrichment
No English description supplied.
No references supplied.
A flaw was found in Starlette, a lightweight ASGI framework. On Windows systems, the StaticFiles component is vulnerable to Server-Side Request Forgery (SSRF). A remote attacker can exploit this by providing a specially crafted Universal Naming Convention (UNC) path, which causes the system to initiate an outbound Server Message Block (SMB) connection. This action can expose the service account's NTLMv2 credentials, potentially leading to information disclosure or further attacks.
- https://access.redhat.com/security/cve/CVE-2026-48818
- https://bugzilla.redhat.com/show_bug.cgi?id=2490020
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48818.json
- https://access.redhat.com/errata/RHSA-2026:30089
- https://access.redhat.com/errata/RHSA-2026:30088
- https://access.redhat.com/errata/RHSA-2026:30087