PT-2026-28176 · Streamlit+1 · Streamlit+1

Sfc-Gh-Pkamdar · Published 2026-03-25 · Updated 2026-03-27 · CVE-2026-33682

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Streamlit versions prior to 1.54.0

Description Streamlit Open Source versions running on Windows hosts are affected by an unauthenticated Server-Side Request Forgery (SSRF) issue. This arises from insufficient validation of filesystem paths provided by an attacker. Specifically, within the ComponentRequestHandler, paths are resolved using os.path.realpath() or Path.resolve() without adequate validation. Supplying a malicious UNC path (e.g., attacker-controlled-hostshare) can cause the Streamlit server to initiate outbound SMB connections over port 445. During this process, NTLMv2 challenge-response credentials of the Windows user running the Streamlit process may be transmitted, potentially allowing an attacker to perform NTLM relay attacks against internal services or identify reachable SMB hosts through timing analysis. Server-Side Request Forgery (SSRF) is a web security flaw that allows an attacker to cause the server to make HTTP requests to an arbitrary domain of the attacker's choosing. NTLMv2 is a network authentication protocol used by Windows.

Recommendations Upgrade to Streamlit Open Source version 1.54.0 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-33682

GHSA-7P48-42J8-8846

Affected Products

Streamlit

Windows

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33682.json · Exploit
• https://github.com/streamlit/streamlit/commit/23692ca70b2f2ac720c72d1feb4f190c9d6eed76 · Patch
• https://github.com/streamlit/streamlit/security/advisories/GHSA-7p48-42j8-8846 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7p48-42j8-8846 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33682 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33682 · Security Note
• https://github.com/streamlit/streamlit/releases/tag/1.54.0 · Note
• https://github.com/streamlit/streamlit · Note
• https://reddit.com/r/VulnMatter/comments/1s473iq/resumen_diario_de_vulnerabilidades_26032026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1s475si/resumen_diario_de_vulnerabilidades_26032026 · Reddit Post
• https://twitter.com/CVEnew/status/2037513422762385643 · Twitter Post
• https://twitter.com/NewsNerdie/status/2037591464243319066 · Twitter Post