Use of Web Browser Cache Containing Sensitive Information in Django - CVE-2026-48588

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU137028

Use of Web Browser Cache Containing Sensitive Information in Django - CVE-2026-48588

Published: July 7, 2026


Vulnerability identifier: #VU137028
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-48588
CWE-ID: CWE-525
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to expose private data via cached responses.

The vulnerability exists due to improper cache handling in django.middleware.cache.UpdateCacheMiddleware and django.views.decorators.cache.cache_page when processing requests that already contain unrelated cookies. A remote attacker can send a request with an unrelated cookie to expose private data via cached responses.

The issue occurs when a response sets a cookie while varying on Cookie.


Affected software

Django
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Package Hub 15
openSUSE Leap
openEuler
Fedora
python3-Django
python-django-help
python-django
python311-Django
python-django5

How to mitigate CVE-2026-48588

Install security update from vendor's website.

Django - addressed in versions 5.2.16, 6.0.7
python3-Django - addressed in versions 2.2.27-23, 4.2.15-17
python-django-help - addressed in versions 2.2.27-23, 4.2.15-17
python-django - addressed in versions 2.2.27-23, 4.2.15-17
python311-Django - update to 4.2.11-150600.3.62.1
python-django5 - addressed in versions 5.2.16-1.fc43, 5.2.16-1.fc44

External References

Related Security Bulletins