PT-2026-21353 · Flask+2 · Flask+2

Shouryaj98 · Published 2026-02-19 · Updated 2026-05-19 · CVE-2026-27205

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Flask versions 3.1.2 and below

Description Flask, a web server gateway interface (WSGI) web application framework, may improperly handle caching when accessing the session object. Specifically, it may fail to set the 'Vary: Cookie' header, potentially leading to a Use of Cache Containing Sensitive Information issue. This occurs when the application is hosted behind a caching proxy that doesn't ignore responses with cookies, lacks a 'Cache-Control' header to mark pages as private or non-cacheable, and accesses the session in a way that only touches keys without reading values or mutating the session. The issue stems from overlooking certain forms of access, such as the Python 'in' operator.

Recommendations Update to Flask version 3.1.3 or later.

Exploit

Fix

Weakness Enumeration

CWE-524

Related Identifiers

CVE-2026-27205

ECHO-32C7-8A8F-5DF3

GHSA-68RP-WP8R-4726

OESA-2026-2135

OESA-2026-2136

OESA-2026-2137

OPENSUSE-SU-2026:10264-1

SUSE-SU-2026:0849-1

USN-8104-1

Affected Products

Flask

Linuxmint

Ubuntu

References · 33

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27205.json · Exploit
• https://github.com/pallets/flask/security/advisories/GHSA-68rp-wp8r-4726 · Vendor Advisory
• https://github.com/pallets/flask/commit/089cb86dd22bff589a4eafb7ab8e42dc357623b4 · Patch
• https://osv.dev/vulnerability/OESA-2026-2137 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10264-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8104-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8104-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-27205 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27205 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27205 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-27205 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27205 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-27205 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2136 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-27205 · Vendor Advisory