Skip to content
OpenAdvisories
Low USN-8104-1 1 CVE

flask vulnerability

Published Mar 18, 2026 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

Shourya Jaiswal discovered that Flask did not correctly mark certain web
responses as user-specific. A remote attacker could possibly use this
issue to obtain sensitive information.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS flask 2.0.1-2ubuntu1.2
Ubuntu · 24.04 LTS 24.04:LTS flask 3.0.2-1ubuntu1.1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS flask 1.1.1-2ubuntu0.1+esm1

Vulnerabilities 1

  • Low 2.3
    CVE-2026-27205

    Flask session does not add `Vary: Cookie` header when accessed in some ways

    Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability. …

    pallets flask open-webui airflow-3 Debian Ubuntu Wolfi PyPI

References

  • report
    https://ubuntu.com/security/CVE-2026-27205