Sentry SDK leaks sensitive session information when `sendDefaultPII` is set to `True`

🗓️ 07 Jul 2026 10:17:28Reported by Python Packaging AdvisoryType

pypa🔗 github.com👁 3 Views

Sentry Django can leak cookies when sendDefaultPII is true; patch in version 1.14.0 removes custom cookie names.

Reporter	Title	Published	Views	Family All 23
FreeBSD	py39-sentry-sdk -- sensitive cookies leak	21 Mar 202300:00	–	freebsd
BDU FSTEC	The vulnerability of the software for generating real-time failure reports in Sentry arises from the need to insert confidential information into the transmitted data. This allows a intruder to gain access to confidential information.	29 Oct 202400:00	–	bdu_fstec
Circl	CVE-2023-28117	22 Mar 202323:36	–	circl
CNNVD	Sentry 安全漏洞	22 Mar 202300:00	–	cnnvd
CVE	CVE-2023-28117	22 Mar 202319:37	–	cve
Cvelist	CVE-2023-28117 Sentry SDK leaks sensitive session information when `sendDefaultPII` is set to `True`	22 Mar 202319:37	–	cvelist
EUVD	EUVD-2023-0828	3 Oct 202520:07	–	euvd
Tenable Nessus	FreeBSD : py39-sentry-sdk -- sensitive cookies leak (15dae5cc-9ee6-4577-a93e-2ab57780e707)	14 Apr 202300:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2023-28117	10 Sep 202500:00	–	nessus
Github Security Blog	Sentry SDK leaks sensitive session information when `sendDefaultPII` is set to `True`	21 Mar 202322:31	–	github

Vulners

Node

pypi sentry-sdkRange0–1.14.0

Source	Link
github	www.github.com/getsentry/sentry-python/security/advisories/GHSA-29pr-6jr8-q5jm
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-28117
github	www.github.com/getsentry/sentry-python/pull/1842
github	www.github.com/getsentry/sentry-python
github	www.github.com/getsentry/sentry-python/releases/tag/1.14.0
pypi	www.pypi.org/project/sentry-sdk
github	www.github.com/advisories/GHSA-29pr-6jr8-q5jm

07 Jul 2026 11:31Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.16.5 - 7.6

EPSS0.00641

SSVC