StackRadar

CVE-2026-48818

High

Advisory

Published 15 Jun 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.004
30th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
143
of 17,781 indexed, latest versions
Container images
174
deployed by those charts
Fix available
1 of 1
affected package

Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows

Carried by container images the latest versions of 143 of 17,781 indexed charts deploy, on 174 images.

Affected packageAffected versionsFixed inImages
starlettepypi0.13.6, 0.13.8, 0.14.1, 0.14.2+31 more1.1.0174
OSV records
GHSA-wqp7-x3pw-xc5r
Also known as
PYSEC-2026-2281

Charts affected

143 by stars
ChartLatestAffected imagesRadar Score
difydify-helmVerified publisher0.38.01 of 11See more

dify dify-helm 0.38.0

1 of the 11 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
langgenius/dify-agent-backend:1.16.1097d3fd27a7b
starlette@1.0.1
1.1.0

Open the chart page →

22,002
wazuhwazuh-helm-morgovedVerified publisher2.0.71 of 5See more

wazuh wazuh-helm-morgoved 2.0.7

1 of the 5 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.14.3f09282d281f6
starlette@0.49.1
1.1.0

Open the chart page →

11,384
syftopenmined0.9.52 of 6See more

syft openmined 0.9.5

2 of the 6 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
openmined/syft-backend:0.9.5b72f74a68b32
starlette@0.45.3
1.1.0
openmined/syft-seaweedfs:0.9.53a4144c0bb82
starlette@0.36.3
1.1.0

Open the chart page →

17,245
wazuhwazuh-helmVerified publisher0.0.81 of 4See more

wazuh wazuh-helm 0.0.8

1 of the 4 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
wazuh/wazuh-manager:4.11.11da5c38c6a78
starlette@0.39.2
1.1.0

Open the chart page →

6,168
openvpn-asas-helm-chartOfficialVerified publisher0.2.11 of 1See more

openvpn-as as-helm-chart 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
openvpn/openvpn-as:latest2253c10ec652
starlette@0.52.1
1.1.0

Open the chart page →

2,668
esphomegeek-cookbookVerified publisher8.4.21 of 1See more

esphome geek-cookbook 8.4.2

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
esphome/esphome:1.18.03f51ec10e823
starlette@0.14.2
1.1.0

Open the chart page →

3,717
mealiegeek-cookbookVerified publisher5.1.21 of 2See more

mealie geek-cookbook 5.1.2

1 of the 2 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
hkotel/mealie:api-v1.0.0beta-2a7e6b6abe087
starlette@0.19.1
1.1.0

Open the chart page →

7,579
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
starlette@0.52.1
1.1.0

Open the chart page →

4,634
klancesklances0.1.41 of 1See more

klances klances 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
ghcr.io/nicolargo/klances:0.1.374d6d33376eb
starlette@0.52.1
1.1.0

Open the chart page →

1,693
mealieth-chartsVerified publisher0.5.11 of 1See more

mealie th-charts 0.5.1

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.7.0bb2939094eed
starlette@0.49.1
1.1.0

Open the chart page →

3,804
clearml-servingallegroaiVerified publisher1.6.21 of 9See more

clearml-serving allegroai 1.6.2

1 of the 9 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
allegroai/clearml-serving-inference:1.3.0fca885e8cfc6
starlette@0.26.1
1.1.0

Open the chart page →

17,877
rommcrystalnetVerified publisher0.2.201 of 3See more

romm crystalnet 0.2.20

1 of the 3 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
zurdi15/romm:2.3.12db88fe44c89
starlette@0.27.0
1.1.0

Open the chart page →

1,944
aibrixdanchevVerified publisher0.7.01 of 5See more

aibrix danchev 0.7.0

1 of the 5 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
aibrix/metadata-service:v0.7.063fb81a64377
starlette@0.38.6
1.1.0

Open the chart page →

5,274
dominodominoVerified publisher0.1.111 of 3See more

domino domino 0.1.11

1 of the 3 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
ghcr.io/tauffer-consulting/domino-rest:latest8bf880fe8c73
starlette@0.27.0
1.1.0

Open the chart page →

8,823
fastapi-microservice-appfast-api-microservice-app1.3.03 of 4See more

fastapi-microservice-app fast-api-microservice-app 1.3.0

3 of the 4 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
omkara25/simple-microservice-app-order-service:v2.18327546c7aac
starlette@0.38.6
1.1.0
omkara25/simple-microservice-app-payment-service:v2afff40172b6b
starlette@0.38.6
1.1.0
omkara25/simple-microservice-app-user-service:v2d62cba548580
starlette@0.38.6
1.1.0

Open the chart page →

9,562
helmuphelmupVerified publisher0.1.01 of 3See more

helmup helmup 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
sirrend/helmup-engine:0.1.13699e79e3d4e2
starlette@0.37.2
1.1.0

Open the chart page →

16,514
backendikusi-bk-chart1.0.32 of 3See more

backend ikusi-bk-chart 1.0.3

2 of the 3 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
kyovint/kyoimgtransactions:1.0.048c19e3ae9a3
starlette@0.47.3
1.1.0
kyovint/kyoimgusers:1.0.080084149156e
starlette@0.47.3
1.1.0

Open the chart page →

5,940
immichimmich-helm0.3.01 of 4See more

immich immich-helm 0.3.0

1 of the 4 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-machine-learning:v2.3.1379e31b8c751
starlette@0.41.2
1.1.0

Open the chart page →

15,712
jessejesse-chartVerified publisher0.0.461 of 6See more

jesse jesse-chart 0.0.46

1 of the 6 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
salehmir/jesse:1.10.101afa95f979e9
starlette@0.37.2
1.1.0

Open the chart page →

3,421
jupyterhub-outpostjupyter-jscVerified publisher2.4.11 of 1See more

jupyterhub-outpost jupyter-jsc 2.4.1

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
jupyterjsc/jupyterhub-outpost:2.3.1aea53b13f235
starlette@1.0.0
1.1.0

Open the chart page →

1,678
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
langgenius/dify-api:0.6.11fca918260dd6
starlette@0.37.2
1.1.0

Open the chart page →

20,403
kubeseal-webguikubeseal-webgui6.0.41 of 2See more

kubeseal-webgui kubeseal-webgui 6.0.4

1 of the 2 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
ghcr.io/jaydee94/kubeseal-webgui/api:4.5.33cceb9462ae1
starlette@0.36.3
1.1.0

Open the chart page →

4,095
litellmlitellm-helm0.2.01 of 1See more

litellm litellm-helm 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
starlette@0.41.3
1.1.0

Open the chart page →

4,292
clowder2ncsaVerified publisher1.9.73 of 12See more

clowder2 ncsa 1.9.7

3 of the 12 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
clowder/clowder2-backend:2.0.0-beta.411f3d844e4c0
starlette@0.26.1
1.1.0
clowder/clowder2-heartbeat:2.0.0-beta.414155326c7b9
starlette@0.26.1
1.1.0
clowder/clowder2-messages:2.0.0-beta.4bf146f1ca24f
starlette@0.26.1
1.1.0

Open the chart page →

37,373
mealiertomik-helm-chartsVerified publisher0.0.21 of 1See more

mealie rtomik-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
ghcr.io/mealie-recipes/mealie:v3.2.1322369a5b748
starlette@0.41.0
1.1.0

Open the chart page →

3,929
vuiseriohub1.0.62 of 3See more

vui seriohub 1.0.6

2 of the 3 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
dserio83/velero-api:0.3.16b3d9115fee2
starlette@0.45.3
1.1.0
dserio83/velero-watchdog:0.1.8d5deae589229
starlette@0.45.3
1.1.0

Open the chart page →

11,532
slo-reportingslo-reportingVerified publisher0.3.341 of 2See more

slo-reporting slo-reporting 0.3.34

1 of the 2 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
ghcr.io/colenio/slo-reporting:0.3.316b64d194a27d
starlette@0.41.3
1.1.0

Open the chart page →

2,928
tocktock0.6.31 of 9See more

tock tock 0.6.3

1 of the 9 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
tock/gen-ai-orchestrator-server:25.10.7abf7880e0449
starlette@0.46.2
1.1.0

Open the chart page →

12,907
airbyteairbyte-v2Verified publisher2.2.01 of 10See more

airbyte airbyte-v2 2.2.0

1 of the 10 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
airbyte/manifest-server:7.23.73b3a670af168
starlette@0.47.3
1.1.0

Open the chart page →

12,473
akto-ai-guardrails-v2akto0.3.02 of 6See more

akto-ai-guardrails-v2 akto 0.3.0

2 of the 6 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
aktosecurity/akto-agent-guard-anonymizer:1.1.4d4b100cbdc47
starlette@0.38.6
1.1.0
aktosecurity/akto-agent-guard-embedder:1.1.4dbc566b2376c
starlette@0.38.6
1.1.0

Open the chart page →

9,321
esphomealekcVerified publisher2.8.11 of 1See more

esphome alekc 2.8.1

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
esphome/esphome:2026.8.285abea33854b
starlette@0.52.1
1.1.0

Open the chart page →

3,112
esphomealexmorbo-esphomeVerified publisher1.0.01 of 1See more

esphome alexmorbo-esphome 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
esphome/esphome:2024.12.2b2c6322700ac
starlette@0.39.2
1.1.0

Open the chart page →

6,324
ansible-inspecansible-inspec0.2.171 of 2See more

ansible-inspec ansible-inspec 0.2.17

1 of the 2 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
ghcr.io/htunn/ansible-inspec:0.2.12cd25a5cc3f1b
starlette@0.52.1
1.1.0

Open the chart page →

5,558
arlas-aiasarlas-stackVerified publisher28.8.01 of 22See more

arlas-aias arlas-stack 28.8.0

1 of the 22 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
ghcr.io/developmentseed/titiler:0.22.48ac53eb38393
starlette@0.46.2
1.1.0

Open the chart page →

40,238
flrepositorydbassist-iot-fl-repository1.1.01 of 2See more

flrepositorydb assist-iot-fl-repository 1.1.0

1 of the 2 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
assistiot/fl_repository:latest0fce3ea719a5
starlette@0.19.1
1.1.0

Open the chart page →

4,367
trainingcollectorassist-iot-fl-training-collector1.1.01 of 1See more

trainingcollector assist-iot-fl-training-collector 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
assistiot/fl_training_collector:latest792715dd3084
starlette@0.16.0
1.1.0

Open the chart page →

1,719
openapiassist-iot-open-api-management0.2.21 of 6See more

openapi assist-iot-open-api-management 0.2.2

1 of the 6 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
assistiot/open_api_backend:1.1.230812ba93555
starlette@0.27.0
1.1.0

Open the chart page →

18,277
azure-app-exporterazure-app-exporterVerified publisher0.4.21 of 2See more

azure-app-exporter azure-app-exporter 0.4.2

1 of the 2 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
ghcr.io/dodevops/azure-app-exporter/azure-app-exporter:0.1.38b472877847f5
starlette@0.17.1
1.1.0

Open the chart page →

1,790
backstage-pyactionsbackstage-pyactionsVerified publisher0.1.01 of 1See more

backstage-pyactions backstage-pyactions 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
mawad98/backstage-pyactions:demo99422c56a274
starlette@1.0.0
1.1.0

Open the chart page →

2,738
colosseumbook-k8sinfra-v21.0.181 of 5See more

colosseum book-k8sinfra-v2 1.0.18

1 of the 5 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
sysnet4admin/colosseum-rwd:log74ded2d92f07
starlette@0.46.2
1.1.0

Open the chart page →

26,996
ctk-walkthroughchaostoolkit-walkthrough0.1.03 of 3See more

ctk-walkthrough chaostoolkit-walkthrough 0.1.0

3 of the 3 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
chaostoolkit/back:latest734f3af86125
starlette@0.13.8
1.1.0
chaostoolkit/front:latest7f4a7eb9f7df
starlette@0.14.1
1.1.0
chaostoolkit/middle:latestb95ba4961cfc
starlette@0.14.1
1.1.0

Open the chart page →

5,557
chat-searchchat-searchVerified publisher0.1.71 of 1See more

chat-search chat-search 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
ghcr.io/hemslo/chat-search:latest39d48995a5bd
starlette@0.37.2
1.1.0

Open the chart page →

4,042
pbcore-utilcluster-deploy0.0.11 of 1See more

pbcore-util cluster-deploy 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
ghcr.io/wgbh-mla/pbcore-util:pr-66e04659a3baa
starlette@0.49.3
1.1.0

Open the chart page →

9,128
csghubcsghubVerified publisher2.4.32 of 34See more

csghub csghub 2.4.3

2 of the 34 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6-52f03fead54db
starlette@0.46.2
1.1.0
opencsghq/csgbot:v0.6.7-eeaf7191a9cf8a
starlette@0.41.2
1.1.0

Open the chart page →

58,897
csgshipcsghubVerified publisher0.4.61 of 10See more

csgship csghub 0.4.6

1 of the 10 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
opencsghq/csgship-agentic:v0.4.02cd29671a03e
starlette@0.41.2
1.1.0

Open the chart page →

11,335
deployhubdeployhubVerified publisher10.0.4157 of 11See more

deployhub deployhub 10.0.415

7 of the 11 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
quay.io/ortelius/ms-compitem-crud:main-v10.0.1566-gf3f81597b7f49eec76
starlette@0.50.0
1.1.0
quay.io/ortelius/ms-dep-pkg-cud:main-v10.0.1670-g9abe110c0c881b509a
starlette@0.50.0
1.1.0
quay.io/ortelius/ms-dep-pkg-r:main-v10.0.1705-g21b3dc8a4150e94a45
starlette@0.50.0
1.1.0
quay.io/ortelius/ms-sbom-export:main-v10.0.933-g2e222ef43bdaa51598
starlette@0.50.0
1.1.0
quay.io/ortelius/ms-scorecard:main-v10.0.1276-g966a8a43337e52fdd4
starlette@0.50.0
1.1.0
quay.io/ortelius/ms-textfile-crud:main-v10.0.1635-g5076aaf5c4c8adfc82
starlette@0.50.0
1.1.0
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
starlette@0.50.0
1.1.0

Open the chart page →

11,160
design-cataloguedesign-catalogue0.1.01 of 2See more

design-catalogue design-catalogue 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
registry.gitlab.com/open-forms/design-catalogue:latestf21f19346b29
starlette@0.14.2
1.1.0

Open the chart page →

2,770
ai-agentdevtron0.0.11 of 1See more

ai-agent devtron 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
starlette@0.40.0
1.1.0

Open the chart page →

9,607
ai-agentdevtron-labs0.0.11 of 1See more

ai-agent devtron-labs 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
starlette@0.40.0
1.1.0

Open the chart page →

9,607
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-48818.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
starlette@0.41.0
1.1.0

Open the chart page →

19,224

Container images carrying it

174 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/openrelik/openrelik-worker-timesketch:latest4cb88b603cdc
starlette@0.46.2
1.1.0
1
ghcr.io/openrelik/openrelik-worker-yara:latestbd7fbf4505b5
starlette@0.46.2
1.1.0
1
ghcr.io/rodg/rtmp-controller:latest67f99a5beab7
starlette@0.17.1
1.1.0
1
ghcr.io/runwhen-contrib/runwhen-local:0.12.0533ce58c6e02
starlette@0.46.2
1.1.0
1
ghcr.io/shadrus/srebot:0.14.09b4415e937b2
starlette@0.52.1
1.1.0
1
ghcr.io/tarkyaio/tarka:0.4.1e8d3f1512f06
starlette@0.52.1
1.1.0
1
ghcr.io/tauffer-consulting/domino-rest:latest8bf880fe8c73
starlette@0.27.0
1.1.0
1
ghcr.io/vinny1892/octantis:latest45459c0910fc
starlette@1.0.0
1.1.0
1
ghcr.io/wgbh-mla/pbcore-util:pr-66e04659a3baa
starlette@0.49.3
1.1.0
1
public.ecr.aws/k6v9y5g3/cluster-agent:cost_k8s_process.5769e14a72b066d
starlette@0.41.3
1.1.0
1
quay.io/ai-lab/llamacpp_python:latest70d138997acd
starlette@0.46.2
1.1.0
1
quay.io/maximilianopizarro/neuroface-backend:v1.4.13194d46df0f9
starlette@0.41.3
1.1.0
1
quay.io/maximilianopizarro/neuroface-backend:latestcba71dc08c8a
starlette@0.41.3
1.1.0
1
quay.io/mongodb/farm-intro-backend:0.11a9ce0b8fbd4
starlette@0.13.6
1.1.0
1
quay.io/ortelius/ms-compitem-crud:main-v10.0.1566-gf3f81597b7f49eec76
starlette@0.50.0
1.1.0
1
quay.io/ortelius/ms-dep-pkg-cud:main-v10.0.1670-g9abe110c0c881b509a
starlette@0.50.0
1.1.0
1
quay.io/ortelius/ms-dep-pkg-r:main-v10.0.1705-g21b3dc8a4150e94a45
starlette@0.50.0
1.1.0
1
quay.io/ortelius/ms-sbom-export:main-v10.0.933-g2e222ef43bdaa51598
starlette@0.50.0
1.1.0
1
quay.io/ortelius/ms-scorecard:main-v10.0.1276-g966a8a43337e52fdd4
starlette@0.50.0
1.1.0
1
quay.io/ortelius/ms-textfile-crud:main-v10.0.1635-g5076aaf5c4c8adfc82
starlette@0.50.0
1.1.0
1
quay.io/ortelius/ms-validate-user:main-v10.0.1694-g98ed94b5054bd4e97a
starlette@0.50.0
1.1.0
1
registry.gitlab.com/open-forms/design-catalogue:latestf21f19346b29
starlette@0.14.2
1.1.0
1
registry.gitlab.com/open-forms/forms-catalogue:latest4eaf9c911f33
starlette@0.14.2
1.1.0
1
registry.gitlab.com/open-forms/request-registry:latest0886cbbc5f95
starlette@0.14.2
1.1.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.