Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache the response, as it may contain information specific to a logged in user. This is handled in most cases, but some forms of access such as the Python in operator were overlooked. The severity and risk depend on the application being hosted behind a caching proxy that doesn't ignore responses with cookies, not setting a Cache-Control header to mark pages as private or non-cacheable, and accessing the session in a way that only touches keys without reading values or mutating the session. The issue has been fixed in version 3.1.3.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1476 advisory.

    Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below,     when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of     Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache the     response, as it may contain information specific to a logged in user. This is handled in most cases, but     some forms of access such as the Python in operator were overlooked. The severity and risk depend on the     application being hosted behind a caching proxy that doesn't ignore responses with cookies, not setting a     Cache-Control header to mark pages as private or non-cacheable, and accessing the session in a way that     only touches keys without reading values or mutating the session. The issue has been fixed in version     3.1.3. (CVE-2026-27205)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8104-1 advisory.

    Shourya Jaiswal discovered that Flask did not correctly mark certain web responses as user-specific. A     remote attacker could possibly use this issue to obtain sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:0849-1 advisory.

    This update for python-Flask fixes the following issue:

    - CVE-2026-27205: information disclosure due to Flask session not adding the `Vary: Cookie` header     (bsc#1258700).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below,     when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of     Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache the     response, as it may contain information specific to a logged in user. This is handled in most cases, but     some forms of access such as the Python in operator were overlooked. The severity and risk depend on the     application being hosted behind a caching proxy that doesn't ignore responses with cookies, not setting a     Cache-Control header to mark pages as private or non-cacheable, and accessing the session in a way that     only touches keys without reading values or mutating the session. The issue has been fixed in version     3.1.3. (CVE-2026-27205)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below,
    when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use of
    Cache Containing Sensitive Information vulnerability. The logic instructs caches not to cache the
    response, as it may contain information specific to a logged in user. This is handled in most cases, but
    some forms of access such as the Python in operator were overlooked. The severity and risk depend on the
    application being hosted behind a caching proxy that doesn't ignore responses with cookies, not setting a
    Cache-Control header to mark pages as private or non-cacheable, and accessing the session in a way that
    only touches keys without reading values or mutating the session. The issue has been fixed in version
    3.1.3. (CVE-2026-27205)

ID	Name	Product	Family	Severity
304287	Amazon Linux 2023 : python3-flask (ALAS2023-2026-1476)	Nessus	Amazon Linux Local Security Checks	low
303031	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : Flask vulnerability (USN-8104-1)	Nessus	Ubuntu Local Security Checks	low
301808	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-Flask (SUSE-SU-2026:0849-1)	Nessus	SuSE Local Security Checks	low
299724	Linux Distros Unpatched Vulnerability : CVE-2026-27205	Nessus	Misc.	low
437883	SCA: security update for flask (GHSA-68rp-wp8r-4726)	Tenable Cloud Security	SCA Checks	low
437883	SCA: security update for flask (GHSA-68rp-wp8r-4726)	Tenable Self-Hosted Container Security	SCA Checks	low

Detections

Analytics

CVE-2026-27205

low

Tenable Plugins

low

low

low

low

low

low