Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker.com\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account’s NTLMv2 credentials for offline cracking or relay even though the HTTP response is only a 404. The issue affects default follow_symlink=False deployments, including frameworks built on Starlette such as FastAPI; POSIX systems and follow_symlink=True are unaffected. The issue is fixed in 1.1.0.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows     is vulnerable to SSRF. An UNC path such as \\attacker.com\share can cause os.path.realpath to initiate an     outbound SMB connection before the path is rejected, exposing the service account's NTLMv2 credentials for     offline cracking or relay even though the HTTP response is only a 404. The issue affects default     follow_symlink=False deployments, including frameworks built on Starlette such as FastAPI; POSIX systems     and follow_symlink=True are unaffected. The issue is fixed in 1.1.0. (CVE-2026-48818)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows
    is vulnerable to SSRF. An UNC path such as \\attacker.com\share can cause os.path.realpath to initiate an
    outbound SMB connection before the path is rejected, exposing the service account’s NTLMv2 credentials for
    offline cracking or relay even though the HTTP response is only a 404. The issue affects default
    follow_symlink=False deployments, including frameworks built on Starlette such as FastAPI; POSIX systems
    and follow_symlink=True are unaffected. The issue is fixed in 1.1.0. (CVE-2026-48818)

ID	Name	Product	Family	Type	Severity
321660	Linux Distros Unpatched Vulnerability : CVE-2026-48818	Nessus	Misc.	Local	high
443240	SCA: security update for starlette (GHSA-wqp7-x3pw-xc5r)	Tenable Cloud Security	SCA Checks	Local	high
443240	SCA: security update for starlette (GHSA-wqp7-x3pw-xc5r)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-48818

high

Tenable Plugins

high

high

high