CVE-2026-48818

Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows

En bref

Sévérité: HIGH 7.5
EPSS: EPSS 0.37 % · centile 30 (2026-10-27)
État: PUBLISHED
Publiée: 2026-06-17
Mise à jour: 2026-08-04
Attribuée par: GitHub_M
Statut NVD: Modified

Description

Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker.com\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account’s NTLMv2 credentials for offline cracking or relay even though the HTTP response is only a 404. The issue affects default follow_symlink=False deployments, including frameworks built on Starlette such as FastAPI; POSIX systems and follow_symlink=True are unaffected. The issue is fixed in 1.1.0.

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	GitHub_M
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	redhat-SADP
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	NVD · security-advisories@github.com (Secondary)
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	NVD · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c (Secondary)

Faiblesses (CWE)

CWE-918

Avis

GHSA-wqp7-x3pw-xc5r — Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows
PYSEC-2026-2281 — Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker.c

Références européennes

ENISA EUVD · EUVD-2026-37773
GCVE · GCVE-0-2026-48818

Avis du CERT-FR

CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
CERTFR-2026-AVI-1378 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2026-AVI-1206 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:encode:starlette:*:*:*:*:*:python:*:* < 1.1.0

Produits affectés

Produit	Versions
Kludex · starlette	affected < 1.1.0

Références

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD