Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

Flask uses fallback key instead of current signing key

🗓️ 07 Jul 2026 16:02:52Reported by Python Packaging AdvisoryType 
pypa
 pypa🔗 github.com👁 3 Views

Flask 3.1.0 built the key list in reverse, causing signing with stale keys for SECRET_KEY_FALLBACKS.

Related
Detection
Refs
ReporterTitlePublishedViews
Family
IBM Security Bulletins		Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses flask-3.1.0-py3-none-any.whl which is vulnerable to this CVE-2025-47278
9 Oct 202514:25
–ibm
IBM Security Bulletins		Security Bulletin: There are multiple vulnerabilities that can affect IBM Fusion
11 Sep 202518:18
–ibm
IBM Security Bulletins		Security Bulletin: A denial-of-service attack, heap use after free, network server exploit, and other vulnerabilities might affect IBM Storage Defender - Resiliency Service
8 Jul 202517:32
–ibm
IBM Security Bulletins		Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which is vulnerable to CVEs.
7 Oct 202507:40
–ibm
IBM Security Bulletins		Security Bulletin: There is a vulnerability in flask-3.1.0-py3-none-any.whl used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2025-47278)
26 Jun 202505:46
–ibm
IBM Security Bulletins		Security Bulletin: Location Service for ESRI Component uses requests-2.32.3, urllib3-2.4.0 and flask-3.1.0 libraries which are vulnerable to CVE-2024-47081, CVE-2025-50181, CVE-2025-50182 and CVE-2025-47278
29 Aug 202514:18
–ibm
IBM Security Bulletins		Security Bulletin: IBM Maximo Application Suite uses WebSphere Application Server Liberty V.25.0.0.2, flask-3.1.0-py3-none-any.whl form-data-2.5.1.tgz and golang.org/x/net which is vulnerable to multiple CVEs
7 Oct 202507:41
–ibm
IBM Security Bulletins		Security Bulletin: IBM watsonx Orchestrate Developer Edition affected by vulnerability in flask-3.1.0-py3-none-any.whl
22 Oct 202511:02
–ibm
IBM Security Bulletins		Security Bulletin: IBM Maximo Application Suite Predict Component : Flask is a web server gateway interface (WSGI) web application framework. In Flask 3.1.0, the way fallback key configuration was handled resulted in the last fallback key being used.
30 May 202508:28
–ibm
IBM Security Bulletins		Security Bulletin: IBM QRadar Investigation Assistant app for IBM QRadar SIEM includes components with known vulnerabilities
28 Jul 202513:19
–ibm
Rows per page
Vulners
Node
pypiflaskRange3.1.0–3.1.1

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
07 Jul 2026 16:02Current
6Medium risk
Vulners AI Score6
CVSS 41.8
EPSS0.00153
SSVC
Flaskkey rotationsigning keyssecret key fallbacksreverse orderitsdangerous
3