Vulnerability · Published Feb 21, 2026 · Assigned by GitHub_M
CVE-2026-27205Flask session does not add `Vary: Cookie` header when accessed in some ways
Low 2.3
In plain English
A low-severity security flaw in flask from pallets. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache the response, as it may contain information specific to a logged in user. This is handled in most cases, but some forms of access such as the Python in operator were overlooked. The severity and risk depend on the application being hosted behind a caching proxy that doesn't ignore responses with cookies, not setting a Cache-Control header to mark pages as private or non-cacheable, and accessing the session in a way that only touches keys without reading values or mutating the session. The issue has been fixed in version 3.1.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | flask | no fix listed | DEBIAN-CVE-2026-27205 |
| Debian:13 | flask | 3.1.1-1+deb13u1 | DEBIAN-CVE-2026-27205 |
| Debian:14 | flask | 3.1.3-1 | DEBIAN-CVE-2026-27205 |
| PyPI | flask | 3.1.3 | GHSA-68rp-wp8r-4726 |
| PyPI | flask | 3.1.3 | PYSEC-2026-2151 |
| Ubuntu:22.04:LTS | flask | 2.0.1-2ubuntu1.2 | USN-8104-1 |
| Ubuntu:22.04:LTS | flask | 2.0.1-2ubuntu1.2 | UBUNTU-CVE-2026-27205 |
| Ubuntu:24.04:LTS | flask | 3.0.2-1ubuntu1.1 | UBUNTU-CVE-2026-27205 |
| Ubuntu:24.04:LTS | flask | 3.0.2-1ubuntu1.1 | USN-8104-1 |
| Ubuntu:25.10 | flask | no fix listed | UBUNTU-CVE-2026-27205 |
Affected products (as reported)
Weakness: CWE-524 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/pallets/flask/security/advisories/GHSA-68rp-wp8r-4726 x_refsource_CONFIRM
- https://github.com/pallets/flask/commit/089cb86dd22bff589a4eafb7ab8e42dc357623b4 x_refsource_MISC
- https://github.com/pallets/flask/releases/tag/3.1.3 x_refsource_MISC