CVE-2026-35193: djangoproject django
Vulnerability summary
CVE-2026-35193 is a low (CVSS 3.1) vulnerability in djangoproject django. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 36.1% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 7 · Related 6Timeline
- 03-06-2026PublishedVulnerability first disclosed.
- 03-06-2026Last modifiedVulnerability information updated.
Description
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. `django.middleware.cache.UpdateCacheMiddleware` in Django does not add `Authorization` to the `Vary` response header for requests bearing that header without `Cache-Control: public`, which allows remote attackers to read private cached responses via unauthenticated requests to the same URL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Shai Berger for reporting this issue.
CVSS metrics
9 scores · 6 sources · 2 versions- OSV · PypiEcosystem advisory · calculated2.3LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated2.3LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated2.3LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · ChainguardEcosystem advisory · calculated2.3LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- NVDNIST2.3LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated3.1LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
- NVDNIST3.1LowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.43%
Chance of exploitation in the next 30 days
Percentile
36%
Versus all other CVEs
30-day change
+0.06 pp
From 0.37% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard2 products
- authentik-2025.12All versions (No fix recorded)
- authentik-fips-2025.12All versions (No fix recorded)
Debian1 product
- python-djangoAll versions (No fix recorded) | < 3:5.2.15-1
Djangoproject1 product
- django≥ 5.2, < 5.2.15 | ≥ 6.0, < 6.0.6
PyPI1 product
- django≥ 5.2.0, < 5.2.15 | ≥ 6.0.0, < 6.0.6 | ≥ 6.0, < 6.0.6
Ubuntu1 product
- python-djangoAll versions (No fix recorded)
5 vendors · 6 products
References
17 links
Show all 17 references
- pypi.org/project/Django/PACKAGE