Answer in brief
CVE-2026-48818 records a High severity (CVSS 7.5) vulnerability in Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows. The current sources do not mark it as known exploited. The current feed maps Kludex/starlette (generic), starlette (pip). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Kludex/starlette (generic), starlette (pip). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:a:encode:starlette:*:*:*:*:*:python:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Kludex/starlettegeneric | < 1.1.0 | Not reported |
| starlettepip | <1.1.0 | 1.1.0 |
Published upstream
Jun 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 19, 2026
Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker.com\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account’s NTLMv2 credentials for offline cracking or relay even though the HTTP response is only a 404. The issue affects default follow_symlink=False deployments, including frameworks built on Starlette such as FastAPI; POSIX systems and follow_symlink=True are unaffected. The issue is fixed in 1.1.0.
Quoted source text, attributed separately from HOL analysis.