← Vulnerability feed

Vulnerability record · CVE-2026-27205 · published 21 February 2026

CVE-2026-27205: Palletsprojects flask vulnerability

PPalletsprojects · Flask

Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache the response, as it may contain information specific to a logged in user. This is handled in most cases, but some forms of access such as the Python in operator were overlooked. The severity and risk depend on the application being hosted behind a caching proxy that doesn't ignore responses with cookies, not setting a Cache-Control header to mark pages as private or non-cacheable, and accessing the session in a way that only touches keys without reading values or mutating the session. The issue has been fixed in version 3.1.3.

2.3 CVSS 4.0 Low EPSS 0.42% · top 65.7% CWE-524 · CWE-524
2.3CVSS 4.0 base score
0.42%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache the response, as it may contain information specific to a logged in user. This is handled in most cases, but some forms of access such as the Python in operator were overlooked. The severity and risk depend on the application being hosted behind a caching proxy that doesn't ignore responses with cookies, not setting a Cache-Control header to mark pages as private or non-cacheable, and accessing the session in a way that only touches keys without reading values or mutating the session. The issue has been fixed in version 3.1.3.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/pallets/flask/commit/089cb86dd22bff589a4eafb7ab8e42dc357623b4 Patch
https://github.com/pallets/flask/releases/tag/3.1.3 ProductRelease Notes
https://github.com/pallets/flask/security/advisories/GHSA-68rp-wp8r-4726 Vendor Advisory

Track CVE-2026-27205 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2023-30861Palletsprojects flask vulnerabilityFlask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one clie…EPSS 1.3%7.5CVE-2019-1010083Palletsprojects flask vulnerabilityThe Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded…EPSS 1.9%7.5CVE-2018-1000656Palletsprojects flask improper input validation vulnerabilityThe Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount o…EPSS 3.9%

Source: NIST National Vulnerability Database (record CVE-2026-27205), CISA KEV, FIRST EPSS (scores of 2026-10-01). This page is refreshed as NVD updates the record.