CVE-2026-48818High· 7.5▾ TwilightA flaw was found in Starlette, a lightweight ASGI framework. On Windows systems, the StaticFiles component is vulnerable to Server-Side Request Forgery (SSRF). A remote attacker can exploit this by providing a specially crafted Universal N…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.4%
0.4% → 0.6%
Last analysed / modified upstream
A flaw was found in Starlette, a lightweight ASGI framework. On Windows systems, the StaticFiles component is vulnerable to Server-Side Request Forgery (SSRF). A remote attacker can exploit this by providing a specially crafted Universal Naming Convention (UNC) path, which causes the system to initiate an outbound Server Message Block (SMB) connection. This action can expose the service account's NTLMv2 credentials, potentially leading to information disclosure or further attacks.
starlette: Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows — rated Important by Red Hat. Released 2026-06-17, updated 2026-10-15.
Fixed:
Not affected:
For more information visit https://access.redhat.com/errata/RHSA-2026:30089 https://access.redhat.com/errata/RHSA-2026:30089 For more information visit https://access.redhat.com/errata/RHSA-2026:30088 https://access.redhat.com/errata/RHSA-2026:30088 For more information visit https://access.redhat.com/errata/RHSA-2026:30087 https://access.redhat.com/errata/RHSA-2026:30087
Workarounds / mitigations:
Affected packages:
starlette < 1.1.0Patched in:
starlette 1.1.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116176High· 8.2vllm: vllm: Information disclosure via SSRF in X-Request-Id header (CVE-2026-116176)
CVE-2026-116192Medium· 5.9github.com/rclone/rclone: rclone: Information disclosure via Server-Side Request Forgery in rc-serve (CVE-2026-116192)
CVE-2026-115877Medium· 5.4twisted: Twisted: HTTP request smuggling via improper header delimiter handling (CVE-2026-115877)
CVE-2026-114138High· 7.5djangorestframework: djangorestframework: Denial of Service via unbounded Accept header parsing (CVE-2026-114138)
CVE-2026-114140High· 7.8nbconvert: nbconvert: arbitrary file write via path traversal in ExtractOutputPreprocessor (CVE-2026-114140)
CVE-2026-114145High· 7.5GitPython: GitPython: arbitrary code execution via improper submodule path validation (CVE-2026-114145)