Flask session does not add `Vary: Cookie` header when accessed in some ways
When the session object is accessed, Flask should set the Vary: Cookie header. This instructs caches not to cache the response, as it may contain information specific to a logged in user. This is handled in most cases, but some forms of access such as the Python in operator were overlooked.
The severity depends on the application's use of the session, and the cache's behavior regarding cookies. The risk depends on all these conditions being met.
- The application must be hosted behind a caching proxy that does not ignore responses with cookies.
- The application does not set a
Cache-Controlheader to indicate that a page is private or should not be cached. - The application accesses the session in a way that does not access the values, only the keys, and does not mutate the session.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | flask | < 3.1.3 | 3.1.3 |
References
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-524- Platform
- Python (PyPI)
- Package
flask- Disclosed
- 19.02.2026
- Updated
- 11.10.2026 15:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-2151 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-68rp-wp8r-4726 - CC BY 4.0
Vulnerability history: flask
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 5
- First → latest
- 08.2018 02.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 3
- Low 2
Disclosures per year
- 2018: 1
- 2019: 1
- 2020: 0
- 2021: 0
- 2022: 0
- 2023: 1
- 2024: 0
- 2025: 1
- 2026: 1
-
Flask session does not add `Vary: Cookie` header when accessed in some ways this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.