7.5

CVE-2026-48818: encode starlette Server-Side Request Forgery (SSRF)

CVSS: 7.5v3.1HighModified
AliasesGHSA-wqp7-x3pw-xc5rPYSEC-2026-2281UBUNTU-CVE-2026-48818
Published 17-06-2026Last modified 04-08-2026
Open JSON

Vulnerability summary

CVE-2026-48818 is a high (CVSS 7.5) Server-Side Request Forgery (SSRF) vulnerability in encode starlette. EPSS estimates a 0.65% chance of exploitation in the next 30 days, higher than 50% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.65%
0%100%
Low · +0.28 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
CGA-F7F4-WQC8-R7F5

Timeline

  1. 17-06-2026
    PublishedVulnerability first disclosed.
  2. 04-08-2026
    Last modifiedVulnerability information updated.

Description

Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker.com\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account’s NTLMv2 credentials for offline cracking or relay even though the HTTP response is only a 404. The issue affects default follow_symlink=False deployments, including frameworks built on Starlette such as FastAPI; POSIX systems and follow_symlink=True are unaffected. The issue is fixed in 1.1.0.

CVSS metrics

6 scores · 6 sources · 1 version

EPSS trend

Probability

0.65%

Chance of exploitation in the next 30 days

Percentile

50%

Versus all other CVEs

30-day change

+0.28 pp

From 0.37% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.65%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard8 products
  • keep-apiAll versions (No fix recorded)
  • keep-api-fipsAll versions (No fix recorded)
  • mlflow< 3.16.0-r0
  • mlrun-apiAll versions (No fix recorded)
  • mlrun-api-fipsAll versions (No fix recorded)
Encode1 product
Kludex1 product
Opensuse1 product
  • python-graphifyy&distro=openSUSE Tumbleweed< 0.9.48-1.1
PyPI1 product
  • starlette< 1.1.0
Ubuntu1 product
  • starletteAll versions (No fix recorded)
Wolfi1 product
  • mlflow< 3.16.0-r0

7 vendors · 14 products

References

17 links
Show all 17 references