PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-48818 Kludex CVE debrief

CVE-2026-48818 is a high-severity Server-Side Request Forgery (SSRF) vulnerability in the StaticFiles feature of Starlette, a lightweight ASGI framework/toolkit, on Windows systems. The vulnerability, with a CVSS score of 7.5, allows an attacker to initiate an outbound SMB connection by exploiting the `os.path.realpath` function, potentially exposing the service account's NTLMv2 credentials for offline cracking or relay attacks. The issue affects default deployments with `follow_symlink=False`, including frameworks built on Starlette such as FastAPI. POSIX systems and deployments with `follow_symlink=True` are not affected. The vulnerability was fixed in version 1.1.0.

Vendor
Kludex
Product
starlette
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-07-15
Advisory published
2026-06-17
Advisory updated
2026-07-15

Who should care

This vulnerability affects developers and administrators using Starlette version 1.0.1 or earlier on Windows systems, especially those using default deployments with `follow_symlink=False`. Frameworks built on Starlette, such as FastAPI, are also impacted. Users of these systems should prioritize upgrading to version 1.1.0 or applying mitigations to prevent exploitation.

Technical summary

The vulnerability lies in the StaticFiles feature of Starlette on Windows. When a UNC path (e.g., `//attacker.com/share`) is provided, `os.path.realpath` may initiate an outbound SMB connection before the path is rejected, potentially exposing the service account's NTLMv2 credentials. This issue arises in default deployments where `follow_symlink=False`, which is the default setting. The vulnerability is characterized by the following CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. CWE-918 (Server-Side Request Forgery) is associated with this vulnerability.

Defensive priority

High

Recommended defensive actions

  • Upgrade Starlette to version 1.1.0 or later.
  • If upgrading is not feasible, configure deployments to use `follow_symlink=True`.
  • Implement network restrictions to limit outbound SMB connections.
  • Monitor for suspicious SMB connections from the service account.
  • Consider using alternative file serving mechanisms that are not vulnerable to SSRF.
  • Apply principle of least privilege to the service account to minimize potential damage.

Evidence notes

The information provided is based on the CVE record and NVD details. The vulnerability was published on June 17, 2026, and last modified on the same day. The CVSS score and vector are provided by the NVD. Fixes and advisories are available on the Starlette GitHub repository.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-48818 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-48818

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-48818 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-48818

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.