CVE-2026-33682
SSRF in Streamlit Windows Server Allows NTLM Credential Exposure
Publication date: 2026-03-26
Last updated on: 2026-04-01
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| snowflake | streamlit | to 1.54.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects Streamlit Open Source versions prior to 1.54.0 running on Windows. It is an unauthenticated Server-Side Request Forgery (SSRF) issue caused by improper validation of attacker-supplied filesystem paths. Specifically, in some code paths like the ComponentRequestHandler, filesystem paths are resolved using functions such as os.path.realpath() or Path.resolve() before proper validation. On Windows, an attacker can supply a malicious UNC path (e.g., \\attacker-controlled-host\share) which causes the Streamlit server to make outbound SMB connections over port 445.
When Windows tries to authenticate to the remote SMB server, it may send NTLMv2 challenge-response credentials of the Windows user running the Streamlit process. This can enable attackers to perform NTLM relay attacks or identify internal SMB hosts through timing analysis.
The vulnerability was fixed in Streamlit Open Source version 1.54.0.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker to make the Streamlit server initiate outbound SMB connections to attacker-controlled hosts. During these connections, the Windows user running the Streamlit process may inadvertently send NTLMv2 authentication credentials.
This can lead to NTLM relay attacks against other internal services, potentially allowing attackers to gain unauthorized access or move laterally within your network.
Additionally, attackers can use timing analysis to discover internally reachable SMB hosts, which can aid in further network reconnaissance and exploitation.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves the Streamlit server on Windows hosts initiating outbound SMB connections over port 445 when processing malicious UNC paths. Detection can focus on monitoring for unusual outbound SMB traffic from the Streamlit server process.
- Monitor network traffic for outbound connections on TCP port 445 originating from the Streamlit server.
- Use Windows network monitoring tools or packet capture utilities (e.g., Wireshark) to detect SMB connection attempts from the Streamlit process.
- Check Windows event logs for authentication attempts or NTLM challenge-response activity related to the Streamlit process.
- Commands to identify SMB connections or related processes might include:
- - Using PowerShell to monitor network connections: `Get-NetTCPConnection -RemotePort 445 | Where-Object { $_.OwningProcess -eq (Get-Process -Name streamlit).Id }`
- - Using netstat to check for outbound SMB connections: `netstat -ano | findstr :445` and correlate the process ID with Streamlit.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been fixed in Streamlit Open Source version 1.54.0. Immediate mitigation steps include upgrading Streamlit to version 1.54.0 or later.
Until the upgrade can be applied, consider restricting outbound SMB traffic (port 445) from the Streamlit server to prevent potential exploitation.
Additionally, monitor for suspicious SMB authentication attempts and review firewall rules to limit unnecessary SMB connections.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows an attacker to cause the Streamlit server on Windows to initiate outbound SMB connections that may transmit NTLMv2 credentials of the Windows user running the Streamlit process. This could lead to unauthorized credential disclosure and potential lateral movement within a network.
Such unauthorized credential exposure and potential internal network compromise could impact compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and credentials to prevent unauthorized access.
However, the provided information does not explicitly state the direct impact on compliance frameworks.