2.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27205

CVE-2026-27205: Flask session does not add `Vary: Cookie` header when accessed in some ways

Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache the response, as it may contain information specific to a logged in user. This is handled in most cases, but some forms of access such as the Python in operator were overlooked. The severity and risk depend on the application being hosted behind a caching proxy that doesn't ignore responses with cookies, not setting a Cache-Control header to mark pages as private or non-cacheable, and accessing the session in a way that only touches keys without reading values or mutating the session. The issue has been fixed in version 3.1.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27205

CVE-2026-27205:

2.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
flask	pip	< 3.1.3	3.1.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in Flask's session management, specifically within the SecureCookieSession class. Before the patch, this class attempted to track whether a session was accessed by overriding a few specific methods like __getitem__, get, and setdefault to set an accessed flag. This flag was then used to add a Vary: Cookie header to responses, preventing caching of user-specific pages.

The flaw was that this implementation was incomplete. It did not account for all possible ways the session could be accessed. For example, read-only operations like checking for a key's existence ('key' in session, which uses __contains__) or getting the number of items (len(session), which uses __len__) did not have corresponding overrides to set the accessed flag.

As a result, if an application accessed the session using one of these overlooked methods without otherwise modifying it, the Vary: Cookie header would not be set. A downstream caching proxy, seeing no instruction not to cache, could then store and serve a page containing user-specific data to other users.

The fix, introduced in commit 089cb86dd22bff589a4eafb7ab8e42dc357623b4, was to centralize access tracking. Instead of relying on individual method overrides in SecureCookieSession, the patch introduced a property getter for session on the RequestContext object (flask.ctx.RequestContext.session). Now, any access to the flask.session proxy triggers this getter, which unconditionally sets the accessed flag on the underlying session object. This ensures that any interaction with the session, read-only or not, correctly marks the response as varying by cookie.

The functions SecureCookieSession.__getitem__, get, and setdefault are identified because their removal in the patch is direct evidence of the old, flawed, and incomplete implementation that caused the vulnerability. They represent the piecemeal approach that was replaced by a comprehensive fix.

Vulnerable functions

SecureCookieSession.__getitem__

src/flask/sessions.py

This function was part of an incomplete implementation for tracking session access. It set `session.accessed = True` for `[]` access, but other read-only access methods like `in` (`__contains__`) were not handled, leading to the vulnerability. The function was removed as part of a fix that centralized access tracking in `RequestContext.session`.

SecureCookieSession.get

src/flask/sessions.py

This function was part of an incomplete implementation for tracking session access. It set `session.accessed = True` for `.get()` access, but other read-only access methods like `in` (`__contains__`) were not handled, leading to the vulnerability. The function was removed as part of a fix that centralized access tracking in `RequestContext.session`.

SecureCookieSession.setdefault

src/flask/sessions.py

This function was part of an incomplete implementation for tracking session access. It set `session.accessed = True` for `.setdefault()` access, but other read-only access methods like `in` (`__contains__`) were not handled, leading to the vulnerability. The function was removed as part of a fix that centralized access tracking in `RequestContext.session`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.