SSRF Vulnerability in Starlette Affects Windows Deployments

CVE-2026-48818

What is CVE-2026-48818?

A vulnerability has been identified in Starlette, a lightweight ASGI framework, affecting versions 1.0.1 and prior. When deployed on Windows, the StaticFiles module is susceptible to SSRF attacks. Exploiting this vulnerability could allow an attacker to craft a UNC path, triggering os.path.realpath and inadvertently establishing an outbound SMB connection. This occurs even when the system returns a 404 response, leading to the potential exposure of the service account's NTLMv2 credentials, which could be used for offline cracking or relay attacks. The vulnerability specifically impacts deployments with default follow_symlink set to False, but does not affect POSIX systems or configurations with follow_symlink set to True. The issue has been addressed in version 1.1.0, so updating is recommended.

References