CVE-2026-27205
📋 TL;DR
Flask versions 3.1.2 and below have a cache vulnerability where accessing session keys with certain Python operators (like 'in') fails to set proper cache headers. This could allow caching proxies to serve cached responses containing user-specific data to other users. Only applications behind caching proxies without proper cookie handling are affected.
💻 Affected Systems
- Flask
📦 What is this software?
Flask by Palletsprojects
⚠️ Risk & Real-World Impact
Worst Case
Sensitive user data (like authentication tokens, personal info) cached and served to unauthorized users, potentially leading to account compromise or data leakage.
Likely Case
Limited information disclosure of session-related data to other users of the same caching proxy, depending on application implementation.
If Mitigated
No impact if proper Cache-Control headers are set or caching proxies ignore cookie-based responses.
🎯 Exploit Status
Exploitation requires specific application code patterns and caching infrastructure. No public exploits known at advisory publication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.3
Vendor Advisory: https://github.com/pallets/flask/security/advisories/GHSA-68rp-wp8r-4726
Restart Required: Yes
Instructions:
1. Update Flask: pip install --upgrade Flask==3.1.3
2. Restart all Flask application instances
3. Verify version with: python -c "import flask; print(flask.__version__)"
🔧 Temporary Workarounds
Add explicit cache headers
allSet Cache-Control headers to prevent caching of sensitive responses
@app.after_request
def add_header(response):
response.headers['Cache-Control'] = 'no-store, no-cache, must-revalidate, max-age=0'
return response
Configure caching proxy
allConfigure reverse proxy/cache to ignore responses with Set-Cookie headers
🧯 If You Can't Patch
- Configure all caching layers to ignore responses with Set-Cookie headers
- Add explicit Cache-Control: private or no-store headers to all Flask responses
🔍 How to Verify
Check if Vulnerable:
Check Flask version: python -c "import flask; print(flask.__version__)" - if version <= 3.1.2, vulnerableCheck Version:
python -c "import flask; print(flask.__version__)"Verify Fix Applied:
Verify Flask version is 3.1.3 or higher: python -c "import flask; print(flask.__version__)"📡 Detection & Monitoring
Log Indicators:
- Cache hits on URLs that should be user-specific
- Multiple users receiving identical cached responses
Network Indicators:
- Responses missing Vary: Cookie header when session accessed
- Cache-Control headers missing on authenticated pages
SIEM Query:
web_server_logs WHERE response_code=200 AND cache_hit=true AND url CONTAINS '/auth' OR url CONTAINS '/session'