Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache the response, as it may contain information specific to a logged in user. This is handled in most cases, but some forms of access such as the Python in operator were overlooked. The severity and risk depend on the application being hosted behind a caching proxy that doesn't ignore responses with cookies, not setting a Cache-Control header to mark pages as private or non-cacheable, and accessing the session in a way that only touches keys without reading values or mutating the session. The issue has been fixed in version 3.1.3.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below,
    when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of
    Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache the
    response, as it may contain information specific to a logged in user. This is handled in most cases, but
    some forms of access such as the Python in operator were overlooked. The severity and risk depend on the
    application being hosted behind a caching proxy that doesn't ignore responses with cookies, not setting a
    Cache-Control header to mark pages as private or non-cacheable, and accessing the session in a way that
    only touches keys without reading values or mutating the session. The issue has been fixed in version
    3.1.3. (CVE-2026-27205)

The version of IBM Cognos Analytics installed on the remote host is 12.0.4 prior to 12.0.4 FP3, or 12.1.x prior to 12.1.3 FP2. It is, therefore, affected by multiple vulnerabilities as referenced in the IBM Security Bulletin No.
7287209:

  - NLTK versions 3.9.2 and prior are vulnerable to arbitrary code execution due to improper input     validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files     without verification or sandboxing. An attacker can supply or replace the JAR file, enabling the     execution of arbitrary Java bytecode at import time. (CVE-2026-0848)

  - The lodash fix for CVE-2021-23337 added validation for the variable option in _.template but did not     apply the same validation to options.imports key names. Both paths flow into the same Function()     constructor sink. When an application passes untrusted input as options.imports key names, an attacker     can inject default-parameter expressions that execute arbitrary code at template compilation time.
    (CVE-2026-4800)

  - cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.
    From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python     buffers (e.g. Hash.update()), this could lead to buffer overflows. (CVE-2026-39892)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1476 advisory.

    Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below,     when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of     Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache the     response, as it may contain information specific to a logged in user. This is handled in most cases, but     some forms of access such as the Python in operator were overlooked. The severity and risk depend on the     application being hosted behind a caching proxy that doesn't ignore responses with cookies, not setting a     Cache-Control header to mark pages as private or non-cacheable, and accessing the session in a way that     only touches keys without reading values or mutating the session. The issue has been fixed in version     3.1.3. (CVE-2026-27205)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8104-1 advisory.

    Shourya Jaiswal discovered that Flask did not correctly mark certain web responses as user-specific. A     remote attacker could possibly use this issue to obtain sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:0849-1 advisory.

    This update for python-Flask fixes the following issue:

    - CVE-2026-27205: information disclosure due to Flask session not adding the `Vary: Cookie` header     (bsc#1258700).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below,     when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of     Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache the     response, as it may contain information specific to a logged in user. This is handled in most cases, but     some forms of access such as the Python in operator were overlooked. The severity and risk depend on the     application being hosted behind a caching proxy that doesn't ignore responses with cookies, not setting a     Cache-Control header to mark pages as private or non-cacheable, and accessing the session in a way that     only touches keys without reading values or mutating the session. The issue has been fixed in version     3.1.3. (CVE-2026-27205)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
462097	Echo: flask: security update to 3.1.1-1+e1	Tenable Cloud Security	Echo Local Security Checks	Local	low
462097	Echo: flask: security update to 3.1.1-1+e1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	low
347960	IBM Cognos Analytics 12.0.4 < 12.0.4 FP3 / 12.1.x < 12.1.3 FP2 Multiple Vulnerabilities (7287209)	Nessus	CGI abuses	Remote	high
304287	Amazon Linux 2023 : python3-flask (ALAS2023-2026-1476)	Nessus	Amazon Linux Local Security Checks	Local	low
303031	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : Flask vulnerability (USN-8104-1)	Nessus	Ubuntu Local Security Checks	Local	low
301808	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-Flask (SUSE-SU-2026:0849-1)	Nessus	SuSE Local Security Checks	Local	low
299724	Linux Distros Unpatched Vulnerability : CVE-2026-27205	Nessus	Misc.	Local	low
437883	SCA: security update for flask (GHSA-68rp-wp8r-4726)	Tenable Cloud Security	SCA Checks	Local	low
437883	SCA: security update for flask (GHSA-68rp-wp8r-4726)	Tenable Self-Hosted Container Security	SCA Checks	Local	low

Detections

Analytics

CVE-2026-27205

low

Tenable Plugins

low

low

high

low

low

low

low

low

low