PT-2026-45948 · Django Software Foundation+1 · Django+1

Jake Howard + 2 · CVE-2026-7666 · Published 2026-06-03 · Updated 2026-07-14

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Django versions prior to 6.0.6 Django versions prior to 5.2.15

Description An issue exists in django.core.mail.backends.smtp.EmailBackend where the system fails to prevent the reuse of a partially-initialized connection following a failed STARTTLS handshake when the fail silently variable is set to True. This allows on-path network attackers to intercept and read email content in cleartext.

Recommendations Update to version 6.0.6 or later. Update to version 5.2.15 or later.

Exploit

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

BDU:2026-10469

BIT-DJANGO-2026-7666

CVE-2026-7666

ECHO-45A8-C123-8D52

GHSA-MM6V-Q8Q9-PGCF

OESA-2026-2659

OESA-2026-2660

OESA-2026-2661

OPENSUSE-SU-2026:10989-1

OPENSUSE-SU-2026:11002-1

OPENSUSE-SU-2026:11003-1

OPENSUSE-SU-2026:11270-1

OPENSUSE-SU-2026:20937-1

PYSEC-2026-200

SUSE-SU-2026:2318-1

Affected Products

Django

Red Os

References · 141

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7666.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-6873 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:11002-1 · Vendor Advisory
• https://djangoproject.com/weblog/2026/jun/03/security-releases · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:11270-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-7666 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8404 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-7666 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7666 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:20937-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2661 · Vendor Advisory
• https://docs.djangoproject.com/en/dev/releases/security · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:2318-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-2659 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-10469 · Security Note