StackRadar

CVE-2026-48818

High

Advisory

Published 15 Jun 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.004
30th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
143
of 17,781 indexed, latest versions
Container images
174
deployed by those charts
Fix available
1 of 1
affected package

Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows

Carried by container images the latest versions of 143 of 17,781 indexed charts deploy, on 174 images.

Affected packageAffected versionsFixed inImages
starlettepypi0.13.6, 0.13.8, 0.14.1, 0.14.2+31 more1.1.0174
OSV records
GHSA-wqp7-x3pw-xc5r
Also known as
PYSEC-2026-2281

Charts affected

143 by stars
ChartLatestAffected imagesRadar Score
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
starlette@0.50.0
1.1.0

Open the chart page →

4,749
dummy-servicephanVerified publisher0.3.41 of 1See more

dummy-service phan 0.3.4

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
phan2410/dummy-service:0.0.89c6ed6de26ca
starlette@0.40.0
1.1.0

Open the chart page →

5,706
phronetisphronetis0.1.271 of 2See more

phronetis phronetis 0.1.27

1 of the 2 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
knspar/phronetis:0.1.4609499d2dc91a
starlette@0.46.2
1.1.0

Open the chart page →

16,196
prompt-dbprompt-dbVerified publisher1.0.71 of 3See more

prompt-db prompt-db 1.0.7

1 of the 3 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
ghcr.io/erlkoenig91/prompt-db-backend:1.0.7ab120359810d
starlette@0.41.3
1.1.0

Open the chart page →

3,332
python-fastapi-postgrespython-fastapi-postgres0.1.01 of 1See more

python-fastapi-postgres python-fastapi-postgres 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
archish27/python-fastapi-postgres:latest6610071a2101
starlette@0.19.1
1.1.0

Open the chart page →

2,983
helm-redchefredchef0.1.01 of 3See more

helm-redchef redchef 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
sharanalwar/redchef-backend:latest8d3cab80df49
starlette@0.27.0
1.1.0

Open the chart page →

4,763
request-registryrequest-registry0.1.01 of 2See more

request-registry request-registry 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
registry.gitlab.com/open-forms/request-registry:latest0886cbbc5f95
starlette@0.14.2
1.1.0

Open the chart page →

2,201
esphomeretsamedocVerified publisher2026.2.51 of 1See more

esphome retsamedoc 2026.2.5

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
esphome/esphome:2024.3.09ab8cc88b28c
starlette@0.35.1
1.1.0

Open the chart page →

7,431
rhbk-neurofacerhbk-neurofaceVerified publisher1.0.01 of 4See more

rhbk-neuroface rhbk-neuroface 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/neuroface-backend:latestcba71dc08c8a
starlette@0.41.3
1.1.0

Open the chart page →

3,781
ai-agentromholdings0.0.11 of 1See more

ai-agent romholdings 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
starlette@0.40.0
1.1.0

Open the chart page →

9,607
rommromm-helm-chartVerified publisher1.5.51 of 3See more

romm romm-helm-chart 1.5.5

1 of the 3 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
rommapp/romm:5.2.03512f2ca4557
starlette@1.0.1
1.1.0

Open the chart page →

3,370
imgtagrotationalVerified publisher0.2.01 of 1See more

imgtag rotational 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
gcr.io/rotationalio-habanero/imgtag:89ec287a534a3170d03
starlette@0.37.2
1.1.0

Open the chart page →

3,312
agentdatarss30.1.01 of 1See more

agentdata rss3 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
starlette@0.36.3
1.1.0

Open the chart page →

3,512
noderss30.7.21 of 3See more

node rss3 0.7.2

1 of the 3 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
ghcr.io/rss3-network/agentdata:0.1.0fd8d3e6e4cdf
starlette@0.36.3
1.1.0

Open the chart page →

4,718
checkmkrtomik-helm-chartsVerified publisher0.1.01 of 1See more

checkmk rtomik-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
checkmk/check-mk-community:2.5.0p6c11b422210c4
starlette@0.50.0
1.1.0

Open the chart page →

7,436
runwhen-localrunwhen-contribVerified publisher0.6.171 of 3See more

runwhen-local runwhen-contrib 0.6.17

1 of the 3 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
ghcr.io/runwhen-contrib/runwhen-local:0.12.0533ce58c6e02
starlette@0.46.2
1.1.0

Open the chart page →

3,707
test-helm-app1saam-helm-test0.1.01 of 1See more

test-helm-app1 saam-helm-test 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
hamidyousefi93/saam-test:latestc34f071f6ed0
starlette@0.27.0
1.1.0

Open the chart page →

3,887
test-helm-app2saam-helm-test0.1.01 of 1See more

test-helm-app2 saam-helm-test 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
asdkant/fastapi-hello-world:latesta23d8bf7c885
starlette@0.14.2
1.1.0

Open the chart page →

2,770
showroom-docs-mcpshowroom-docs-mcpVerified publisher2.1.01 of 4See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
litellm/litellm-non_root:v1.82.3-stable09b217802ded
starlette@0.49.1
1.1.0

Open the chart page →

5,201
mealiesmarthallVerified publisher0.0.101 of 1See more

mealie smarthall 0.0.10

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
starlette@0.37.2
1.1.0

Open the chart page →

5,565
srebotsrebot0.14.01 of 2See more

srebot srebot 0.14.0

1 of the 2 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
ghcr.io/shadrus/srebot:0.14.09b4415e937b2
starlette@0.52.1
1.1.0

Open the chart page →

1,542
horcruxstakewise1.0.11 of 1See more

horcrux stakewise 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
stakewiselabs/bls-horcrux:v1.0.02afd0c0b34cb
starlette@0.13.6
1.1.0

Open the chart page →

1,421
verbasubstratusVerified publisher0.4.01 of 1See more

verba substratus 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
substratusai/verba:v0.4.0-baseURL261695be635eb
starlette@0.27.0
1.1.0

Open the chart page →

13,390
surogate-hubsurogate-hubVerified publisher2.1.51 of 1See more

surogate-hub surogate-hub 2.1.5

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
starlette@1.0.0
1.1.0

Open the chart page →

3,460
take-the-helmtake-the-helm0.1.01 of 1See more

take-the-helm take-the-helm 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
cadmusthefounder/lnd:take-the-helm-0.1.0e596c5fbf80f
starlette@0.19.1
1.1.0

Open the chart page →

805
tarkatarkaOfficialVerified publisher0.4.11 of 4See more

tarka tarka 0.4.1

1 of the 4 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
ghcr.io/tarkyaio/tarka:0.4.1e8d3f1512f06
starlette@0.52.1
1.1.0

Open the chart page →

1,556
asrtest-opea1.0.01 of 1See more

asr test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
opea/asr:1.025dd26d9cd09
starlette@0.38.5
1.1.0

Open the chart page →

4,393
chatqnatest-opea1.0.05 of 11See more

chatqna test-opea 1.0.0

5 of the 11 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
opea/chatqna:1.038c51b791efa
starlette@0.38.5
1.1.0
opea/embedding-tei:1.05c9639de61c1
starlette@0.38.5
1.1.0
opea/llm-tgi:1.00c25aab3f106
starlette@0.38.5
1.1.0
opea/reranking-tei:1.0e48613afb191
starlette@0.38.5
1.1.0
opea/retriever-redis:1.0eb746b263705
starlette@0.38.5
1.1.0

Open the chart page →

39,090
codegentest-opea1.0.02 of 5See more

codegen test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
opea/codegen:1.058f91683892d
starlette@0.38.5
1.1.0
opea/llm-tgi:1.00c25aab3f106
starlette@0.38.5
1.1.0

Open the chart page →

28,814
codetranstest-opea1.0.02 of 5See more

codetrans test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
opea/codetrans:1.0e2436483b73d
starlette@0.38.5
1.1.0
opea/llm-tgi:1.00c25aab3f106
starlette@0.38.5
1.1.0

Open the chart page →

28,385
docsumtest-opea1.0.02 of 5See more

docsum test-opea 1.0.0

2 of the 5 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
opea/docsum:1.03eaa91849512
starlette@0.38.5
1.1.0
opea/llm-docsum-tgi:1.002f9e8fa5d71
starlette@0.38.5
1.1.0

Open the chart page →

28,858
embedding-usvctest-opea1.0.01 of 1See more

embedding-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
opea/embedding-tei:1.05c9639de61c1
starlette@0.38.5
1.1.0

Open the chart page →

5,185
guardrails-usvctest-opea1.0.01 of 1See more

guardrails-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
opea/guardrails-tgi:1.0262c6048aab8
starlette@0.38.5
1.1.0

Open the chart page →

5,221
llm-uservicetest-opea1.0.01 of 1See more

llm-uservice test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
opea/llm-tgi:1.00c25aab3f106
starlette@0.38.5
1.1.0

Open the chart page →

4,720
reranking-usvctest-opea1.0.01 of 1See more

reranking-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
opea/reranking-tei:1.0e48613afb191
starlette@0.38.5
1.1.0

Open the chart page →

4,985
retriever-usvctest-opea1.0.01 of 1See more

retriever-usvc test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
opea/retriever-redis:1.0eb746b263705
starlette@0.38.5
1.1.0

Open the chart page →

5,198
speecht5test-opea1.0.01 of 1See more

speecht5 test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
opea/speecht5:1.0249afad3d268
starlette@0.38.5
1.1.0

Open the chart page →

9,616
ttstest-opea1.0.01 of 1See more

tts test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
opea/tts:1.0257ae94709e9
starlette@0.38.5
1.1.0

Open the chart page →

4,377
web-retrievertest-opea1.0.01 of 1See more

web-retriever test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
opea/web-retriever-chroma:1.0fe08165d7770
starlette@0.38.5
1.1.0

Open the chart page →

5,350
kasa-exporterth-chartsVerified publisher0.1.01 of 1See more

kasa-exporter th-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
thelande/kasa_exporter:v0.2.3a1fdb8baa152
starlette@0.37.2
1.1.0

Open the chart page →

1,515
tfy-grafanatruefoundryVerified publisher0.1.211 of 3See more

tfy-grafana truefoundry 0.1.21

1 of the 3 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.1.2716b0b33ff2d
starlette@0.49.3
1.1.0

Open the chart page →

1,062
truefoundry-monitoringtruefoundryVerified publisher0.1.61 of 8See more

truefoundry-monitoring truefoundry 0.1.6

1 of the 8 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
quay.io/kiwigrid/k8s-sidecar:2.1.2716b0b33ff2d
starlette@0.49.3
1.1.0

Open the chart page →

4,526
wazuhwazuh-helm-eksVerified publisher1.2.101 of 6See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.14.45a065930682d
starlette@0.49.1
1.1.0

Open the chart page →

5,484

Container images carrying it

174 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
sysnet4admin/colosseum-rwd:log74ded2d92f07
starlette@0.46.2
1.1.0
1
thelande/kasa_exporter:v0.2.3a1fdb8baa152
starlette@0.37.2
1.1.0
1
tock/gen-ai-orchestrator-server:25.10.7abf7880e0449
starlette@0.46.2
1.1.0
1
wazuh/wazuh-manager:4.11.11da5c38c6a78
starlette@0.39.2
1.1.0
1
wazuh/wazuh-manager:4.14.45a065930682d
starlette@0.49.1
1.1.0
1
wazuh/wazuh-manager:4.14.3f09282d281f6
starlette@0.49.1
1.1.0
1
witcherek7/pav:0.0.342a744f29ac0
starlette@0.22.0
1.1.0
1
yetiplatform/yeti:2.9.09bcbe2650a14
starlette@0.46.2
1.1.0
1
yetiplatform/yeti:latest9c3006cedcca
starlette@0.46.2
1.1.0
1
zepai/knowledge-graph-mcp:v0.2.16ab0ee79926b
starlette@0.47.1
1.1.0
1
zurdi15/romm:2.3.12db88fe44c89
starlette@0.27.0
1.1.0
1
gcr.io/rotationalio-habanero/imgtag:89ec287a534a3170d03
starlette@0.37.2
1.1.0
1
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
starlette@0.41.3
1.1.0
1
ghcr.io/colenio/slo-reporting:0.3.316b64d194a27d
starlette@0.41.3
1.1.0
1
ghcr.io/danny-avila/librechat-rag-api-dev-lite:latestf9f34c8ed688
starlette@0.46.2
1.1.0
1
ghcr.io/developmentseed/titiler:0.22.48ac53eb38393
starlette@0.46.2
1.1.0
1
ghcr.io/dodevops/azure-app-exporter/azure-app-exporter:0.1.38b472877847f5
starlette@0.17.1
1.1.0
1
ghcr.io/erlkoenig91/prompt-db-backend:1.0.7ab120359810d
starlette@0.41.3
1.1.0
1
ghcr.io/eslupmi/impulse:v3.7.03ded1b7ebca0
starlette@0.49.3
1.1.0
1
ghcr.io/esphome/esphome:latest000c5ee5ee96
starlette@0.52.1
1.1.0
1
ghcr.io/esphome/esphome:2026.4.078a82d810709
starlette@0.52.1
1.1.0
1
ghcr.io/gamosoft/notediscovery:0.31.5c06aa0fa9a85
starlette@0.27.0
1.1.0
1
ghcr.io/hemslo/chat-search:latest39d48995a5bd
starlette@0.37.2
1.1.0
1
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
starlette@0.46.0
1.1.0
1
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
starlette@0.50.0
1.1.0
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
starlette@0.52.1
1.1.0
1
ghcr.io/htunn/ansible-inspec:0.2.12cd25a5cc3f1b
starlette@0.52.1
1.1.0
1
ghcr.io/iisas/domino-rest:latest3009350bfc11
starlette@0.47.3
1.1.0
1
ghcr.io/immich-app/immich-machine-learning:v2.3.1379e31b8c751
starlette@0.41.2
1.1.0
1
ghcr.io/immich-app/immich-machine-learning:v3.1.05a0839dc5303
starlette@0.50.0
1.1.0
1
ghcr.io/invergent-ai/surogate-hub:latest6d4106724d56
starlette@1.0.0
1.1.0
1
ghcr.io/jaydee94/kubeseal-webgui/api:4.5.33cceb9462ae1
starlette@0.36.3
1.1.0
1
ghcr.io/kubiyabot/sdk-py:v1.20.0f108f49570cc
starlette@0.39.2
1.1.0
1
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
starlette@0.41.0
1.1.0
1
ghcr.io/mealie-recipes/mealie:v1.4.0b56da41cf178
starlette@0.37.2
1.1.0
1
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
starlette@0.49.1
1.1.0
1
ghcr.io/nicolargo/klances:0.1.374d6d33376eb
starlette@0.52.1
1.1.0
1
ghcr.io/openrelik/openrelik-mediator:latest42efc445b19e
starlette@0.46.2
1.1.0
1
ghcr.io/openrelik/openrelik-metrics:latest3d0f1ddeebf5
starlette@0.46.2
1.1.0
1
ghcr.io/openrelik/openrelik-server:latestce1132261523
starlette@0.46.2
1.1.0
1
ghcr.io/openrelik/openrelik-worker-analyzer-config:latest1269d3d8d2c2
starlette@0.46.2
1.1.0
1
ghcr.io/openrelik/openrelik-worker-analyzer-logs:latestb175cc61959a
starlette@0.46.2
1.1.0
1
ghcr.io/openrelik/openrelik-worker-bulkextractor:latest67498ee2e639
starlette@0.46.2
1.1.0
1
ghcr.io/openrelik/openrelik-worker-chromecreds:latest76d4fbcc6ff0
starlette@0.46.2
1.1.0
1
ghcr.io/openrelik/openrelik-worker-containers:latesta6d5abe94706
starlette@0.46.2
1.1.0
1
ghcr.io/openrelik/openrelik-worker-extraction:latestec9fc5864cd5
starlette@0.46.2
1.1.0
1
ghcr.io/openrelik/openrelik-worker-grep:latest470ff3529746
starlette@0.46.2
1.1.0
1
ghcr.io/openrelik/openrelik-worker-os-creds:latest7fc7ec101f08
starlette@0.46.2
1.1.0
1
ghcr.io/openrelik/openrelik-worker-plaso:latest75537ea8c851
starlette@0.46.2
1.1.0
1
ghcr.io/openrelik/openrelik-worker-strings:latest6e05055b701f
starlette@0.46.2
1.1.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.