CVE-2026-15920

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15920", "assignerOrgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "state": "PUBLISHED", "assignerShortName": "DSF", "dateReserved": "2026-07-15T20:32:49.882Z", "datePublished": "2026-08-04T15:48:40.537Z", "dateUpdated": "2026-08-04T17:21:13.428Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "shortName": "DSF", "dateUpdated": "2026-08-04T15:48:40.537Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-83", "description": "CWE-83: Improper Neutralization of Script in Attributes in a Web Page", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-244", "descriptions": [{"lang": "en", "value": "CAPEC-244: XSS Targeting URI Placeholders"}]}], "title": "Potential cross-site scripting via URLField values in the admin", "metrics": [{"other": {"content": {"value": "moderate", "namespace": "https://docs.djangoproject.com/en/dev/internals/security/#security-issue-severity-levels"}, "type": "Django severity rating"}}, {"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM"}}, {"cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "baseScore": 5.1, "baseSeverity": "MEDIUM"}}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\n`django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link.\r\nExploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input.\nDjango would like to thank Egor Saltykov for reporting this issue.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.</p><p><code>django.contrib.admin.utils.display_for_field()</code> renders <code>URLField</code> values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link.</p><p>Exploitation requires the unsafe value to already be stored in the database. <code>URLField</code> validation through a <code>ModelForm</code> or the admin rejects unsafe schemes, so this affects applications that persist <code>URLField</code> data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input.</p><p>Django would like to thank Egor Saltykov for reporting this issue.</p>"}]}], "affected": [{"collectionURL": "https://pypi.org/project/Django/", "defaultStatus": "unaffected", "packageName": "django", "product": "Django", "repo": "https://github.com/django/django/", "vendor": "djangoproject", "versions": [{"status": "affected", "version": "6.0", "lessThan": "6.0.8", "versionType": "python"}, {"status": "unaffected", "version": "6.0.8", "versionType": "python"}, {"status": "affected", "version": "5.2", "lessThan": "5.2.17", "versionType": "python"}, {"status": "unaffected", "version": "5.2.17", "versionType": "python"}]}], "references": [{"url": "https://docs.djangoproject.com/en/dev/releases/security/", "name": "Django security archive", "tags": ["vendor-advisory"]}, {"url": "https://groups.google.com/g/django-announce", "name": "Django releases announcements", "tags": ["mailing-list"]}, {"tags": ["patch"], "url": "https://github.com/django/django/commit/47511a21026cdd721d8fbf8571cc079bc38bb46d"}, {"tags": ["patch"], "url": "https://github.com/django/django/commit/5a260d309a4c8010c2ebda24eb758a5d95e2508a"}, {"tags": ["patch"], "url": "https://github.com/django/django/commit/13debb622a32720bda1bccda7622fd14fbf3931b"}, {"tags": ["patch"], "url": "https://github.com/django/django/commit/b9adb81339cc418f8f56b1050cca6dfec3ab6349"}, {"url": "https://www.djangoproject.com/weblog/2026/aug/04/security-releases/", "name": "Django security releases issued: 6.0.8 and 5.2.17", "tags": ["vendor-advisory"]}], "credits": [{"lang": "en", "type": "reporter", "value": "Egor Saltykov"}, {"lang": "en", "type": "remediation developer", "value": "Natalia Bidart"}, {"lang": "en", "type": "coordinator", "value": "Natalia Bidart"}], "timeline": [{"lang": "en", "time": "2026-07-13T00:00:00.000Z", "value": "Initial report received."}, {"lang": "en", "time": "2026-07-21T00:00:00.000Z", "value": "Vulnerability confirmed."}, {"lang": "en", "time": "2026-08-04T10:00:00.000Z", "value": "Security release issued."}], "datePublic": "2026-08-04T10:00:00.000Z", "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-04T17:16:24.319084Z", "id": "CVE-2026-15920", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-04T17:21:13.428Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-15920", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-04T17:16:24.319084Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-04T17:21:05.231Z"}}], "cna": {"title": "Potential cross-site scripting via URLField values in the admin", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Egor Saltykov"}, {"lang": "en", "type": "remediation developer", "value": "Natalia Bidart"}, {"lang": "en", "type": "coordinator", "value": "Natalia Bidart"}], "impacts": [{"capecId": "CAPEC-244", "descriptions": [{"lang": "en", "value": "CAPEC-244: XSS Targeting URI Placeholders"}]}], "metrics": [{"other": {"type": "Django severity rating", "content": {"value": "moderate", "namespace": "https://docs.djangoproject.com/en/dev/internals/security/#security-issue-severity-levels"}}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}, {"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}}], "affected": [{"repo": "https://github.com/django/django/", "vendor": "djangoproject", "product": "Django", "versions": [{"status": "affected", "version": "6.0", "lessThan": "6.0.8", "versionType": "python"}, {"status": "unaffected", "version": "6.0.8", "versionType": "python"}, {"status": "affected", "version": "5.2", "lessThan": "5.2.17", "versionType": "python"}, {"status": "unaffected", "version": "5.2.17", "versionType": "python"}], "packageName": "django", "collectionURL": "https://pypi.org/project/Django/", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-07-13T00:00:00.000Z", "value": "Initial report received."}, {"lang": "en", "time": "2026-07-21T00:00:00.000Z", "value": "Vulnerability confirmed."}, {"lang": "en", "time": "2026-08-04T10:00:00.000Z", "value": "Security release issued."}], "datePublic": "2026-08-04T10:00:00.000Z", "references": [{"url": "https://docs.djangoproject.com/en/dev/releases/security/", "name": "Django security archive", "tags": ["vendor-advisory"]}, {"url": "https://groups.google.com/g/django-announce", "name": "Django releases announcements", "tags": ["mailing-list"]}, {"url": "https://github.com/django/django/commit/47511a21026cdd721d8fbf8571cc079bc38bb46d", "tags": ["patch"]}, {"url": "https://github.com/django/django/commit/5a260d309a4c8010c2ebda24eb758a5d95e2508a", "tags": ["patch"]}, {"url": "https://github.com/django/django/commit/13debb622a32720bda1bccda7622fd14fbf3931b", "tags": ["patch"]}, {"url": "https://github.com/django/django/commit/b9adb81339cc418f8f56b1050cca6dfec3ab6349", "tags": ["patch"]}, {"url": "https://www.djangoproject.com/weblog/2026/aug/04/security-releases/", "name": "Django security releases issued: 6.0.8 and 5.2.17", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\n`django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link.\r\nExploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input.\nDjango would like to thank Egor Saltykov for reporting this issue.", "supportingMedia": [{"type": "text/html", "value": "<p>An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.</p><p><code>django.contrib.admin.utils.display_for_field()</code> renders <code>URLField</code> values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link.</p><p>Exploitation requires the unsafe value to already be stored in the database. <code>URLField</code> validation through a <code>ModelForm</code> or the admin rejects unsafe schemes, so this affects applications that persist <code>URLField</code> data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input.</p><p>Django would like to thank Egor Saltykov for reporting this issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-83", "description": "CWE-83: Improper Neutralization of Script in Attributes in a Web Page"}]}], "providerMetadata": {"orgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "shortName": "DSF", "dateUpdated": "2026-08-04T15:48:40.537Z"}}}, "cveMetadata": {"cveId": "CVE-2026-15920", "state": "PUBLISHED", "dateUpdated": "2026-08-04T17:21:13.428Z", "dateReserved": "2026-07-15T20:32:49.882Z", "assignerOrgId": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "datePublished": "2026-08-04T15:48:40.537Z", "assignerShortName": "DSF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://pypi.org/project/Django/", "defaultStatus": "unaffected", "packageName": "django", "product": "Django", "repo": "https://github.com/django/django/", "vendor": "djangoproject", "versions": [{"lessThan": "6.0.8", "status": "affected", "version": "6.0", "versionType": "python"}, {"status": "unaffected", "version": "6.0.8", "versionType": "python"}, {"lessThan": "5.2.17", "status": "affected", "version": "5.2", "versionType": "python"}, {"status": "unaffected", "version": "5.2.17", "versionType": "python"}]}], "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*", "matchCriteriaId": "E20DAA60-EC17-41F8-A6F0-C6F42F887FE6", "versionEndExcluding": "5.2.17", "versionStartIncluding": "5.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*", "matchCriteriaId": "D2E4E199-5735-4911-92F2-73B0AA1D173E", "versionEndExcluding": "6.0.8", "versionStartIncluding": "6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8.\n`django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin pages, which allows cross-site scripting against staff users who click the link.\r\nExploitation requires the unsafe value to already be stored in the database. `URLField` validation through a `ModelForm` or the admin rejects unsafe schemes, so this affects applications that persist `URLField` data without running model validation, for example through direct queryset writes, deserialization, or bulk import of untrusted input.\nDjango would like to thank Egor Saltykov for reporting this issue."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en Django 5.2 anterior a 5.2.17 y 6.0 anterior a 6.0.8.\n\u2019django.contrib.admin.utils.display_for_field()\u2019 renderiza los valores de \u2019URLField\u2019 como enlaces clicables en el administrador sin validar la URL. Un valor almacenado con un esquema inseguro se muestra como un enlace en las p\u00e1ginas de lista de cambios y de administraci\u00f3n de solo lectura, lo que permite cross-site scripting contra los usuarios del personal que hacen clic en el enlace.\nLa explotaci\u00f3n requiere que el valor inseguro ya est\u00e9 almacenado en la base de datos. La validaci\u00f3n de \u2019URLField\u2019 a trav\u00e9s de un \u2019ModelForm\u2019 o el administrador rechaza los esquemas inseguros, por lo que esto afecta a las aplicaciones que persisten datos de \u2019URLField\u2019 sin ejecutar la validaci\u00f3n del modelo, por ejemplo, mediante escrituras directas de queryset, deserializaci\u00f3n o importaci\u00f3n masiva de entrada no confiable.\nDjango desea agradecer a Egor Saltykov por informar de este problema."}], "id": "CVE-2026-15920", "lastModified": "2026-10-24T16:10:00.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15920", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-04T17:16:24.319084Z", "version": "2.0.3"}}]}, "published": "2026-08-04T17:16:46.733", "references": [{"source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "tags": ["Patch", "Vendor Advisory"], "url": "https://docs.djangoproject.com/en/dev/releases/security/"}, {"source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "tags": ["Patch"], "url": "https://github.com/django/django/commit/13debb622a32720bda1bccda7622fd14fbf3931b"}, {"source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "tags": ["Patch"], "url": "https://github.com/django/django/commit/47511a21026cdd721d8fbf8571cc079bc38bb46d"}, {"source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "tags": ["Patch"], "url": "https://github.com/django/django/commit/5a260d309a4c8010c2ebda24eb758a5d95e2508a"}, {"source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "tags": ["Patch"], "url": "https://github.com/django/django/commit/b9adb81339cc418f8f56b1050cca6dfec3ab6349"}, {"source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "tags": ["Mailing List"], "url": "https://groups.google.com/g/django-announce"}, {"source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "tags": ["Vendor Advisory"], "url": "https://www.djangoproject.com/weblog/2026/aug/04/security-releases/"}], "sourceIdentifier": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-83"}], "source": "6a34fbeb-21d4-45e7-8e0a-62b95bc12c92", "type": "Secondary"}]}

{"bugzilla": {"description": "django: Django: Cross-site scripting via unvalidated URLField values in the admin", "id": "2511091", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511091"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-79", "details": ["A flaw was found in Django. The `django.contrib.admin.utils.display_for_field()` function renders `URLField` values as clickable links in the administrative interface without proper validation. If an application persists `URLField` data containing an unsafe scheme without running model validation, a remote attacker could store a malicious URL. When a staff user clicks this link on changelist or read-only admin pages, it could lead to cross-site scripting (XSS), allowing the attacker to execute arbitrary scripts in the user's browser."], "name": "CVE-2026-15920", "package_state": [{"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Out of support scope", "package_name": "ansible-automation-platform-24/controller-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Out of support scope", "package_name": "ansible-automation-platform-24/eda-controller-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Out of support scope", "package_name": "ansible-automation-platform-24/hub-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Out of support scope", "package_name": "ansible-automation-platform-24/lightspeed-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Out of support scope", "package_name": "ansible-automation-platform-25/ansible-dev-tools-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Out of support scope", "package_name": "ansible-automation-platform-25/controller-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Out of support scope", "package_name": "ansible-automation-platform-25/eda-controller-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Out of support scope", "package_name": "ansible-automation-platform-25/gateway-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Out of support scope", "package_name": "ansible-automation-platform-25/hub-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Out of support scope", "package_name": "ansible-automation-platform-25/lightspeed-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-26/ansible-dev-tools-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-26/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-26/eda-controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-26/gateway-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-26/hub-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-26/lightspeed-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-27/aap-cloud-billing-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-27/ansible-dev-tools-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-27/controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-27/eda-controller-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-27/gateway-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-27/hub-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-27/lightspeed-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-27/metrics-service-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Out of support scope", "package_name": "ansible-automation-platform/automation-dashboard-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform-tech-preview/metrics-service-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Out of support scope", "package_name": "automation-controller", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Fix deferred", "package_name": "python-django", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:discovery:2::el9", "fix_state": "Fix deferred", "package_name": "discovery/discovery-server-rhel9", "product_name": "Red Hat Discovery 2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Out of support scope", "package_name": "python-django20", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Out of support scope", "package_name": "python-django", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Fix deferred", "package_name": "python-django", "product_name": "Red Hat OpenStack Platform 18.0"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Fix deferred", "package_name": "python-django", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Fix deferred", "package_name": "satellite-capsule:el8/python-django", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Fix deferred", "package_name": "satellite/iop-advisor-backend-rhel9", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:rhui:4::el8", "fix_state": "Out of support scope", "package_name": "python-django", "product_name": "Red Hat Update Infrastructure 4 for Cloud Providers"}, {"cpe": "cpe:/a:redhat:rhui:5::el9", "fix_state": "Fix deferred", "package_name": "rhui5/rhua-rhel9", "product_name": "Red Hat Update Infrastructure 5"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform/bootc-automation-portal-rhel9", "product_name": "Self-service automation portal 2"}], "public_date": "2026-08-04T15:48:40Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-15920\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-15920\nhttps://docs.djangoproject.com/en/dev/releases/security/\nhttps://github.com/django/django/commit/13debb622a32720bda1bccda7622fd14fbf3931b\nhttps://github.com/django/django/commit/47511a21026cdd721d8fbf8571cc079bc38bb46d\nhttps://github.com/django/django/commit/5a260d309a4c8010c2ebda24eb758a5d95e2508a\nhttps://github.com/django/django/commit/b9adb81339cc418f8f56b1050cca6dfec3ab6349\nhttps://groups.google.com/g/django-announce\nhttps://www.djangoproject.com/weblog/2026/aug/04/security-releases/"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.0,6.0.8)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "6.0.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.2,5.2.17)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "5.2.17"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Django", "source": "cna", "vendor": "djangoproject"}, "product": "django", "vendor": "djangoproject"}], "created": "2026-08-04T18:00:13.355884+00:00", "updated": "2026-08-05T13:45:03.911968+00:00", "vendors": ["djangoproject", "djangoproject$PRODUCT$django"]}