CVE-2026-35193: Potential exposure of private data via missing Vary: Authorization in UpdateCacheMiddleware
An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. django.middleware.cache.UpdateCacheMiddleware in Django does not add Authorization to the Vary response header for requests bearing that header without Cache-Control: public, which allows remote attackers to read private cached responses via unauthenticated requests to the same URL. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Shai Berger for reporting this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 5.2.15 - Upgrade
Upgrade
Djangoto a version that resolves this vulnerability.Fixed in 6.0.6 - Configuration
Update/patch Django so UpdateCacheMiddleware adds the Authorization value to the Vary response header when handling requests bearing an Authorization header but lacking Cache-Control: public, preventing private cached responses from being served to unauthenticated users.
Django middleware.cache.UpdateCacheMiddleware Vary header = Include Authorization in Vary for requests with Authorization header (without Cache-Control: public)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35193?
The severity of CVE-2026-35193 is rated low with a score of 3.1.
How do I fix CVE-2026-35193?
To fix CVE-2026-35193, upgrade Django to version 5.2.15 or 6.0.6 or later.
What data is at risk due to CVE-2026-35193?
CVE-2026-35193 potentially exposes private data due to the missing Vary: Authorization in UpdateCacheMiddleware.
Which versions of Django are affected by CVE-2026-35193?
CVE-2026-35193 affects Django versions prior to 5.2.15 and 6.0.6.
What type of attack can exploit CVE-2026-35193?
CVE-2026-35193 can be exploited by remote attackers who can read private data due to improper caching behavior.