Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Flask Web App May Leak User Info via Caching
published 6 months ago
Summary
Flask's session handling has a bug that could allow cached information about a user to be leaked. This only happens if your Flask app is behind a caching proxy that doesn't follow certain rules. To fix this, update to version 3.1.3 of Flask.
What to do
- Update openeuler python-flask to version 2.2.5-2.oe2403sp1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| openEuler:24.03-LTS-SP1 | openeuler | python-flask |
< 2.2.5-2.oe2403sp1 Fix: upgrade to 2.2.5-2.oe2403sp1
|
Original advisory text
python-flask security update
Flask is a lightweight WSGI web application framework. It is designed to make getting started quick and easy, with the ability to scale up to complex applications. It began as a simple wrapper around Werkzeug and Jinja and has become one of the most popular Python web application frameworks.
Security Fix(es):
Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache the response, as it may contain information specific to a logged in user. This is handled in most cases, but some forms of access such as the Python in operator were overlooked. The severity and risk depend on the application being hosted behind a caching proxy that doesn't ignore responses with cookies, not setting a Cache-Control header to mark pages as private or non-cacheable, and accessing the session in a way that only touches keys without reading values or mutating the session. The issue has been fixed in version 3.1.3.(CVE-2026-27205)
Security Fix(es):
Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache the response, as it may contain information specific to a logged in user. This is handled in most cases, but some forms of access such as the Python in operator were overlooked. The severity and risk depend on the application being hosted behind a caching proxy that doesn't ignore responses with cookies, not setting a Cache-Control header to mark pages as private or non-cacheable, and accessing the session in a way that only touches keys without reading values or mutating the session. The issue has been fixed in version 3.1.3.(CVE-2026-27205)
References
- https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-27205 Vendor Advisory
Timeline
Published3 May 2026
Updated3 May 2026
First seen3 May 2026
Sources
OESA-2026-2137 · OSV
Track software like this
Free during beta