CVE-2026-48818 is a Server-Side Request Forgery (SSRF) vulnerability in the Starlette ASGI framework's StaticFiles feature on Windows platforms. In versions 1.0.1 and earlier, when follow_symlink is false (the default), an attacker can supply a UNC path (e.g., \\attacker.com\share) that causes os.path.realpath to initiate an outbound SMB connection before rejecting the path. This behavior can leak the service account's NTLMv2 credentials, which can be captured for offline cracking or relay attacks, despite the HTTP response being a 404. The vulnerability does not affect POSIX systems or deployments with follow_symlink set to true. The issue is resolved in Starlette version 1.1.0. Red Hat has published advisories referencing this CVE and its mitigation.

The vulnerability allows an unauthenticated remote attacker to cause the affected Starlette application running on Windows to initiate outbound SMB connections to attacker-controlled servers. This can lead to exposure of the service account's NTLMv2 credentials, which attackers may capture and attempt to crack offline or use in relay attacks. The confidentiality of the service account credentials is at risk, but there is no direct impact on integrity or availability. POSIX systems and configurations with follow_symlink enabled are not impacted.

A fix is available in Starlette version 1.1.0. Users and developers should upgrade to version 1.1.0 or later to remediate this vulnerability. Deployments on Windows should avoid using versions earlier than 1.1.0 with default follow_symlink=false settings. Since this is not a cloud service, remediation requires updating the affected software. Consult the Red Hat advisories for additional guidance and patches if using Red Hat distributions.