PT-2026-21353

🗓️ 19 Feb 2026 00:00:00Reported by Positive TechnologiesType

ptsecurity

ptsecurity🔗 dbugs.ptsecurity.com👁 4 Views

Flask 3.1.2 and earlier may reveal cached session data via Vary: Cookie; fixed in 3.1.3.

Reporter	Title	Published	Views	Family All 57
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.	1 Apr 202607:22	–	ibm
IBM Security Bulletins	Security Bulletin:Flask Vary Cookie Header Vulnerability: Use of Cache Containing Sensitive Information Fixed in 3.1.3	4 May 202612:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses flask-3.1.2-py3-none-any.whl which is vulnerable to CVE-2026-27205.	6 Apr 202618:34	–	ibm
IBM Security Bulletins	Security Bulletin: Investigation Assistant App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	6 Apr 202617:16	–	ibm
IBM Security Bulletins	Security Bulletin: Location Service for ESRI Component uses cryptography-46.0.3, flask-3.1.2 and werkzeug-3.1.5 library which were vulnerable to CVE-2026-26007, CVE-2026-27205 and CVE-2026-27199 respectively	30 Mar 202615:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in flask-3.1.2-py3-none-any.whl	1 Jun 202617:08	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.1.1	31 Mar 202616:18	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses qs-6.14.1.tgz and flask-3.0.3-py3-none-any.whl which is vulnerable to CVE-2026-2391 and CVE-2026-27205.	6 Apr 202613:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Scheduler Optimizer uses flask-3.1.2-py3-none-any.whl which is vulnerable to CVE-2026-27205	7 May 202614:00	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability affect underscore-umd-min, werkzeug-3.1.5, flask-3.1.1, cryptography, aircompressor, pyasn1, http, log4j, apache2-build, commons-configuration, bcpkix-jdk18on, server-MariaDB, Jline, IBM COS Systems (April 2026)	26 May 202613:44	–	ibm

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-27205
osv	www.osv.dev/vulnerability/openSUSE-SU-2026:10264-1
ubuntu	www.ubuntu.com/security/CVE-2026-27205
osv	www.osv.dev/vulnerability/DEBIAN-CVE-2026-27205
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27205.json
suse	www.suse.com/support/update/announcement/2026/suse-su-20260849-1
osv	www.osv.dev/vulnerability/UBUNTU-CVE-2026-27205
github	www.github.com/cisagov/Malcolm/discussions/945
github	www.github.com/pallets/flask/security/advisories/GHSA-68rp-wp8r-4726
osv	www.osv.dev/vulnerability/USN-8104-1

15 Apr 2026 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.14.3

CVSS 42.3

EPSS0.00014

SSVC

Flask web framework Session handling Vary Cookie header Cache vulnerability Version 3.1.2 Fixed in 3.1.3