Use of Web Browser Cache Containing Sensitive Information in Django - CVE-2026-6907

Vulnerability identifier: #VU130192

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-6907

CWE-ID: CWE-525

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper cache handling in django.middleware.cache.UpdateCacheMiddleware when processing responses whose Vary header contains an asterisk ('*'). A remote attacker can trigger caching of private data to disclose sensitive information.

Private data may be stored in the cache and later served to other users.

Django
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Ubuntu
SUSE Package Hub 15
openSUSE Leap
openEuler
Fedora
python-django (Ubuntu package)
python3-django (Ubuntu package)
python-django-common (Ubuntu package)
python-django
python-django-help
python3-Django
python311-Django
python-django5
python-django6

Install security update from vendor's website.

Django - addressed in versions 5.2.14, 6.0.5
python-django (Ubuntu package) - addressed in versions 1.6.11-0ubuntu1.3+esm12, 1.8.7-1ubuntu5.15+esm13, 1:1.11.11-1ubuntu1.21+esm17
python3-django (Ubuntu package) - addressed in versions 1.8.7-1ubuntu5.15+esm13, 1:1.11.11-1ubuntu1.21+esm17, 2:2.2.12-1ubuntu0.29+esm10, 2:3.2.12-2ubuntu1.27, 3:4.2.11-1ubuntu1.16, 3:5.2.4-1ubuntu2.5, 3:5.2.9-0ubuntu4.1
python-django-common (Ubuntu package) - addressed in versions 1.8.7-1ubuntu5.15+esm13, 1:1.11.11-1ubuntu1.21+esm17
python-django - addressed in versions 2.2.27-23, 4.2.15-15
python-django-help - addressed in versions 2.2.27-23, 4.2.15-15
python3-Django - addressed in versions 2.2.27-23, 4.2.15-15
python311-Django - update to 4.2.11-150600.3.56.1
python-django5 - addressed in versions 5.2.14-1.fc42, 5.2.14-1.fc43, 5.2.14-1.fc44
python-django6 - update to 6.0.5-1.fc44

• https://www.djangoproject.com/weblog/2026/may/05/security-releases/
• https://github.com/django/django/commit/c79bdfc1351ef2a2ad95df36241a74c736ef20a1

• Multiple vulnerabilities in Django
• Ubuntu update for python-django
• SUSE update for python-Django
• openEuler 24.03 LTS SP3 update for python-django
• openEuler 24.03 LTS SP1 update for python-django
• openEuler 24.03 LTS update for python-django
• openEuler 22.03 LTS SP4 update for python-django
• Fedora 44 update for python-django6
• Fedora 43 update for python-django5
• Fedora 44 update for python-django5
• Fedora 42 update for python-django5
• openEuler 20.03 LTS SP4 update for python-django
• Ubuntu update for python-django