Skip to content
fr Sign in
7.5 High

CVE-2026-48818 Starlette is a lightweight ASGI framework/toolkit

Description

Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker.com\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account’s NTLMv2 credentials for offline cracking or relay even though the HTTP response is only a 404. The issue affects default follow_symlink=False deployments, including frameworks built on Starlette such as FastAPI; POSIX systems and follow_symlink=True are unaffected. The issue is fixed in 1.1.0.

Affected products and versions

Product Affected versions Fixed in
starlette 1.1 earliest → < 1.1.0 1.1.0
Red Hat AI Inference Server 3.3 1782352847 earliest → < 1782352847 1782352847
Exploit Intelligence Versions not published
Migration Toolkit for Applications 8 Versions not published
OpenShift Lightspeed Versions not published
Red Hat AI Inference Server Versions not published
Red Hat Ansible Automation Platform 2 Versions not published
Red Hat Enterprise Linux AI (RHEL AI) 3 Versions not published
Red Hat Hardened Images Versions not published
Show the 2 other branches
Product Affected versions Fixed in
Red Hat OpenShift AI (RHOAI) Versions not published
Red Hat Satellite 6 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of starlette

The 6 CVEs of starlette →
CVE-2026-54283 Starlette is a lightweight ASGI framework/toolkit 7.5 High CVE-2026-54282 Starlette is a lightweight ASGI framework/toolkit 3.7 Low CVE-2026-48817 Starlette is a lightweight ASGI framework/toolkit 5.3 Medium CVE-2026-48710 Kludex Starlette HTTP Request/Response Smuggling Vulnerability 6.5 Medium
Track this CVE