AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-918

https://access.redhat.com/errata/RHSA-2026:30087

https://access.redhat.com/errata/RHSA-2026:30088

https://access.redhat.com/errata/RHSA-2026:30089

https://access.redhat.com/security/cve/CVE-2026-48818

https://bugzilla.redhat.com/show_bug.cgi?id=2490020

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48818.json

[{"vendor":"Red Hat","product":"Red Hat AI Inference Server 3.3","defaultStatus":"affected","cpes":["cpe:/a:redhat:ai_inference_server:3.3::el9"]},{"vendor":"Red Hat","product":"Exploit Intelligence","defaultStatus":"unaffected","cpes":["cpe:/a:redhat:exploit_intelligence:0"]},{"vendor":"Red Hat","product":"Migration Toolkit for Applications 8","defaultStatus":"unaffected","cpes":["cpe:/a:redhat:migration_toolkit_applications:8"]},{"vendor":"Red Hat","product":"OpenShift Lightspeed","defaultStatus":"unaffected","cpes":["cpe:/a:redhat:openshift_lightspeed"]},{"vendor":"Red Hat","product":"Red Hat AI Inference Server","defaultStatus":"unaffected","cpes":["cpe:/a:redhat:ai_inference_server:3"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"unaffected","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux AI (RHEL AI) 3","defaultStatus":"unaffected","cpes":["cpe:/a:redhat:enterprise_linux_ai:3"]},{"vendor":"Red Hat","product":"Red Hat Hardened Images","defaultStatus":"unaffected","cpes":["cpe:/a:redhat:hummingbird:1"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","defaultStatus":"unaffected","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6","defaultStatus":"unaffected","cpes":["cpe:/a:redhat:satellite:6"]}]

OR
          *cpe:2.3:a:encode:starlette:*:*:*:*:*:python:*:* versions up to (excluding) 1.1.0

GitHub, Inc.: https://github.com/Kludex/starlette/commit/fd53168a7767b6b55ba5af787fd88f49e33cabc5 Types: Patch

GitHub, Inc.: https://github.com/Kludex/starlette/pull/3287 Types: Patch

GitHub, Inc.: https://github.com/Kludex/starlette/releases/tag/1.1.0 Types: Release Notes

GitHub, Inc.: https://github.com/Kludex/starlette/security/advisories/GHSA-wqp7-x3pw-xc5r Types: Mitigation, Vendor Advisory

{"timestamp":"2026-06-17T19:31:32.312592Z","id":"CVE-2026-48818","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker.com\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account’s NTLMv2 credentials for offline cracking or relay even though the HTTP response is only a 404. The issue affects default follow_symlink=False deployments, including frameworks built on Starlette such as FastAPI; POSIX systems and follow_symlink=True are unaffected. The issue is fixed in 1.1.0.

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-918

https://github.com/Kludex/starlette/commit/fd53168a7767b6b55ba5af787fd88f49e33cabc5

https://github.com/Kludex/starlette/pull/3287

https://github.com/Kludex/starlette/releases/tag/1.1.0

https://github.com/Kludex/starlette/security/advisories/GHSA-wqp7-x3pw-xc5r

[{"vendor":"Kludex","product":"starlette","versions":[{"version":"< 1.1.0","status":"affected"}]}]