CVE-2026-27205

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27205", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-18T19:47:02.155Z", "datePublished": "2026-02-21T05:21:17.214Z", "dateUpdated": "2026-02-24T19:03:11.374Z"}, "containers": {"cna": {"title": "Flask session does not add `Vary: Cookie` header when accessed in some ways", "problemTypes": [{"descriptions": [{"cweId": "CWE-524", "lang": "en", "description": "CWE-524: Use of Cache Containing Sensitive Information", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 2.3, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/pallets/flask/security/advisories/GHSA-68rp-wp8r-4726", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pallets/flask/security/advisories/GHSA-68rp-wp8r-4726"}, {"name": "https://github.com/pallets/flask/commit/089cb86dd22bff589a4eafb7ab8e42dc357623b4", "tags": ["x_refsource_MISC"], "url": "https://github.com/pallets/flask/commit/089cb86dd22bff589a4eafb7ab8e42dc357623b4"}, {"name": "https://github.com/pallets/flask/releases/tag/3.1.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/pallets/flask/releases/tag/3.1.3"}], "affected": [{"vendor": "pallets", "product": "flask", "versions": [{"version": "< 3.1.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-21T05:21:17.214Z"}, "descriptions": [{"lang": "en", "value": "Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache the response, as it may contain information specific to a logged in user. This is handled in most cases, but some forms of access such as the Python in operator were overlooked. The severity and risk depend on the application being hosted behind a caching proxy that doesn't ignore responses with cookies, not setting a Cache-Control header to mark pages as private or non-cacheable, and accessing the session in a way that only touches keys without reading values or mutating the session. The issue has been fixed in version 3.1.3."}], "source": {"advisory": "GHSA-68rp-wp8r-4726", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-24T19:02:52.515600Z", "id": "CVE-2026-27205", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T19:03:11.374Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27205", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-24T19:02:52.515600Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T19:03:04.896Z"}}], "cna": {"title": "Flask session does not add `Vary: Cookie` header when accessed in some ways", "source": {"advisory": "GHSA-68rp-wp8r-4726", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "pallets", "product": "flask", "versions": [{"status": "affected", "version": "< 3.1.3"}]}], "references": [{"url": "https://github.com/pallets/flask/security/advisories/GHSA-68rp-wp8r-4726", "name": "https://github.com/pallets/flask/security/advisories/GHSA-68rp-wp8r-4726", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/pallets/flask/commit/089cb86dd22bff589a4eafb7ab8e42dc357623b4", "name": "https://github.com/pallets/flask/commit/089cb86dd22bff589a4eafb7ab8e42dc357623b4", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/pallets/flask/releases/tag/3.1.3", "name": "https://github.com/pallets/flask/releases/tag/3.1.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache the response, as it may contain information specific to a logged in user. This is handled in most cases, but some forms of access such as the Python in operator were overlooked. The severity and risk depend on the application being hosted behind a caching proxy that doesn't ignore responses with cookies, not setting a Cache-Control header to mark pages as private or non-cacheable, and accessing the session in a way that only touches keys without reading values or mutating the session. The issue has been fixed in version 3.1.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-524", "description": "CWE-524: Use of Cache Containing Sensitive Information"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-21T05:21:17.214Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27205", "state": "PUBLISHED", "dateUpdated": "2026-02-24T19:03:11.374Z", "dateReserved": "2026-02-18T19:47:02.155Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-21T05:21:17.214Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "flask", "vendor": "pallets", "versions": [{"status": "affected", "version": "< 3.1.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:palletsprojects:flask:*:*:*:*:*:*:*:*", "matchCriteriaId": "C52F4A9B-A92B-4063-8D3B-11DA13291DCE", "versionEndExcluding": "3.1.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache the response, as it may contain information specific to a logged in user. This is handled in most cases, but some forms of access such as the Python in operator were overlooked. The severity and risk depend on the application being hosted behind a caching proxy that doesn't ignore responses with cookies, not setting a Cache-Control header to mark pages as private or non-cacheable, and accessing the session in a way that only touches keys without reading values or mutating the session. The issue has been fixed in version 3.1.3."}, {"lang": "es", "value": "Flask es un framework de aplicaci\u00f3n web de interfaz de puerta de enlace de servidor web (WSGI). En las versiones 3.1.2 e inferiores, cuando se accede al objeto de sesi\u00f3n, Flask deber\u00eda establecer el encabezado Vary: Cookie, lo que resulta en una vulnerabilidad de Uso de Cach\u00e9 que Contiene Informaci\u00f3n Sensible. La l\u00f3gica instruye a las cach\u00e9s a no almacenar en cach\u00e9 la respuesta, ya que puede contener informaci\u00f3n espec\u00edfica de un usuario autenticado. Esto se maneja en la mayor\u00eda de los casos, pero algunas formas de acceso, como el operador in de Python, fueron pasadas por alto. La severidad y el riesgo dependen de que la aplicaci\u00f3n est\u00e9 alojada detr\u00e1s de un proxy de cach\u00e9 que no ignore las respuestas con cookies, de no establecer un encabezado Cache-Control para marcar las p\u00e1ginas como privadas o no almacenables en cach\u00e9, y de acceder a la sesi\u00f3n de una manera que solo toque las claves sin leer los valores o mutar la sesi\u00f3n. El problema ha sido solucionado en la versi\u00f3n 3.1.3."}], "id": "CVE-2026-27205", "lastModified": "2026-06-17T10:26:50.700", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27205", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-24T19:02:52.515600Z", "version": "2.0.3"}}]}, "published": "2026-02-21T06:17:00.910", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/pallets/flask/commit/089cb86dd22bff589a4eafb7ab8e42dc357623b4"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/pallets/flask/releases/tag/3.1.3"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/pallets/flask/security/advisories/GHSA-68rp-wp8r-4726"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-524"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "flask: Flask: Information disclosure via improper caching of session data", "id": "2441596", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2441596"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-524", "details": ["Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache the response, as it may contain information specific to a logged in user. This is handled in most cases, but some forms of access such as the Python in operator were overlooked. The severity and risk depend on the application being hosted behind a caching proxy that doesn't ignore responses with cookies, not setting a Cache-Control header to mark pages as private or non-cacheable, and accessing the session in a way that only touches keys without reading values or mutating the session. The issue has been fixed in version 3.1.3.", "A flaw was found in Flask, a Web Server Gateway Interface (WSGI) web application framework. When a Flask application accesses the session object using certain methods, it may fail to set the `Vary: Cookie` header. This oversight can cause sensitive, user-specific information to be improperly cached by a caching proxy, potentially leading to information disclosure to unauthorized parties."], "name": "CVE-2026-27205", "package_state": [{"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Out of support scope", "package_name": "rhoai/odh-kf-notebook-controller-rhel8", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Out of support scope", "package_name": "rhoai/odh-notebook-controller-rhel8", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:quay:3", "fix_state": "Out of support scope", "package_name": "quay/quay-rhel8", "product_name": "Red Hat Quay 3"}, {"cpe": "cpe:/a:redhat:quay:3", "fix_state": "Fix deferred", "package_name": "quay/quay-rhel9", "product_name": "Red Hat Quay 3"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Fix deferred", "package_name": "satellite/iop-advisor-engine-rhel9", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Fix deferred", "package_name": "satellite/iop-host-inventory-rhel9", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Fix deferred", "package_name": "satellite/iop-insights-engine-rhel9", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Fix deferred", "package_name": "satellite/iop-vulnerability-engine-rhel9", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-02-21T05:21:17Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-27205\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-27205\nhttps://github.com/pallets/flask/commit/089cb86dd22bff589a4eafb7ab8e42dc357623b4\nhttps://github.com/pallets/flask/releases/tag/3.1.3\nhttps://github.com/pallets/flask/security/advisories/GHSA-68rp-wp8r-4726"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.1.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "flask", "source": "cna", "vendor": "pallets"}, "product": "flask", "vendor": "pallets"}], "analysis": {"en": {"generated_at": "2026-04-17T16:54:17.098036+00:00", "value": {"mitigation_remediation": ["Upgrade to Flask 3.1.3 or later to incorporate the header fix.", "Configure any reverse or CDN proxy to respect the Vary: Cookie header and to avoid caching responses that contain cookies.", "If upgrading is not immediately possible, ensure the application sets Cache\u2011Control: private or no\u2011store headers on all pages that could access session data, or modify the code to manually add the Vary header when session keys are touched without mutating the session."], "summary": {"action": "Immediate Patch", "impact": "Use of Cache Containing Sensitive Information"}, "threat_synthesis": {"affected_systems": "All installations of Flask 3.1.2 or earlier, including standard deployments of the pallets:flask framework.", "description_and_impact": "Flask 3.1.2 and earlier miss the Vary: Cookie header when the session object is accessed, which can lead to the response being cached by intermediate proxies when the request includes a cookie. This allows a caching system to store a page that may contain user\u2011specific data and later serve it to other users, thus exposing sensitive information.", "risk_and_exploitability": "The CVSS score of 2.3 indicates low severity, and the EPSS score of less than 1% reflects a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the application to sit behind a caching proxy that does not respect the Vary header and for the attacker to benefit from responses that contain a cookie. Under typical public\u2013facing deployments this risk is mitigated unless a caching layer injects or stores cookies for authenticated sessions, in which case the threat becomes more realistic."}}}}, "created": "2026-02-23T14:32:41.858552+00:00", "updated": "2026-04-17T17:00:10.186640+00:00", "vendors": ["pallets", "pallets$PRODUCT$flask"]}